This local elevation of privilege vulnerability in iTunes can cause big problems for Windows users

Cyfirma Research recently discovered a serious vulnerability in the security of iTunes users on Windows systems.

Classified as CVE-2024-44193, this local elevation of privilege vulnerability allows attackers with limited access to elevate their privileges, potentially compromising entire systems.

Vulnerability present in iTunes for Windows version 12.13.2.3 and earlier, poses a critical threat to the security of systems, so timely updates and patches are essential.

An urgent iTunes update eliminates this risk of escalation

The core issue of CVE-2024-44193 is improper permission management, specifically related to AppleMobileDeviceService.exe.

Attackers could exploit the CVE-2024-44193 vulnerability by manipulating files in C:\ProgramData\Apple\Closing catalog With inadequate permission settings, even low-privilege users can write arbitrary files to this directory, allowing attackers to create opportunities for privilege escalation.

This vulnerability is not difficult to activate, and therefore its exploitation is of particular concern because attackers can use various tools, such as NTFS mounts and opportunistic locks, to create complex exploit chains that lead to the execution of arbitrary code with elevated privileges.

The CVE-2024-44193 exploit follows a structured sequence of steps that allows attackers to manipulate AppleMobileDeviceService.exe and gain elevated privileges. First, attackers create arbitrary files in the Lockdown directory using tools like Oplock to stop processes at key points. They can then use NTFS connections that redirect deleted files to critical system areas.

These actions culminate in the deletion of core system files, giving the attacker administrative access. The ease of use combined with the widespread use of iTunes, especially in enterprise environments, increases the risk profile of the vulnerability. Organizations are encouraged to update iTunes to version 12.13.3 or later to reduce risk.

The impact of this vulnerability is severe because it gives an attacker administrative access to the target system. With SYSTEM level privileges, attackers can manipulate system files, install malwareaccess confidential data and even disrupt services. This makes CVE-2024-44193 a critical vulnerability for organizations, especially those with large numbers of unmanaged or legacy systems running vulnerable versions of iTunes.

At this time, there is no confirmed evidence that this vulnerability is actively being exploited in the wild, and there is no active discussion of this vulnerability in underground forums. However, its potential for widespread use remains high due to the low complexity of the attack.

CVE-2024-44193 affects iTunes for Windows worldwide, affecting a variety of industries that rely on Windows-based systems. Media and entertainment, education, government, and corporate environments are particularly vulnerable due to the widespread use of iTunes. Additionally, organizations that handle sensitive data or operate in high-risk environments may face an increased risk of attacks.