More iOS 10 woes: Some users can’t sync music between devices

from thenextweb.com

This morning has basically been a disaster for Apple. First its highly-anticipated roll-out of iOS 10 welcomed users with a bricked device. Now, following the release of iOS 12.5.1, users report they can no longer connect to iCloud Music Library — the lynchpin required to sync music across supported devices.

iPhone, iPad, iPod touch, Mac or Windows (and Linux) PC users are all susceptible to whatever is causing the issue and many are finding their content inaccessible while the service is down.

When attempting to access the feature after today’s update, users are met with the following error message. After clicking ‘OK’ the message disappears, only to reappear seconds later.

We’ve reached out to Apple for comment and we’ll update if necessary.

Researcher publishes proof-of-concept exploit for iTunes

from http://www.infosecurity-magazine.com
A researcher with Zero Science Lab in Macedonia has published a proof-of-concept exploit of an iTunes flaw that allows remote code execution by an attacker.

The vulnerability is the result of a boundary error in iTunes’ processing of a playlist file. It can be exploited by an attacker to cause a heap buffer overflow when a user opens the specially crafted .m3u file, explained Gjoko Krstic in a blog post.

By exploiting the vulnerability, an attacker could execute arbitrary code on the affected node to gain control of the device, he explained.

Apple patched the vulnerability with the latest version of iTunes, 10.6.3, which it released last week. According to the security update, iTunes 10.6.3 fixes a heap buffer overflow in the handling of .m3u playlists; “importing a maliciously crafted .m3u playlist may lead to an unexpected application termination or arbitrary code execution.” Apple acknowledged the assistance of Krstic in finding and fixing this flaw.

In addition, the latest version of iTunes plugged a memory corruption issue in WebKit. If the user visited a maliciously crafted website, this could lead to an unexpected application termination or arbitrary code execution.

According to Lysa Myers with Intego, no malware has been found that exploits the iTunes vulnerability identified by Krstic. “But it’s often just a matter of time before malware writers incorporate this code into their creations to get onto computers without you knowing, much like Flashback did with its Java exploit”, Myers wrote on the Mac Security blog.

--------------------------------------------------------------------------------------------------------

Of course, if this does develop into something, the sad thing is most Mac users would not be prepared for it.