CVE-2009-0143

Apple iTunes before 8.1 does not properly inform the user about the origin of an authentication request, which makes it easier for remote podcast servers to trick a user into providing a username and password when subscribing to a crafted podcast.

• CWE-200

• http://lists.apple.com/archives/security-announce//2009/Mar/msg00001.htmlMailing List, Patch, Vendor Advisory
• http://osvdb.org/52579Broken Link
• http://secunia.com/advisories/34254Third Party Advisory
• http://securitytracker.com/id?1021843Third Party Advisory, VDB Entry
• http://support.apple.com/kb/HT3487Patch, Vendor Advisory
• http://www.securityfocus.com/bid/34094Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/0702Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49201Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5336Third Party Advisory
• http://lists.apple.com/archives/security-announce//2009/Mar/msg00001.htmlMailing List, Patch, Vendor Advisory
• http://osvdb.org/52579Broken Link
• http://secunia.com/advisories/34254Third Party Advisory
• http://securitytracker.com/id?1021843Third Party Advisory, VDB Entry
• http://support.apple.com/kb/HT3487Patch, Vendor Advisory
• http://www.securityfocus.com/bid/34094Third Party Advisory, VDB Entry
• http://www.vupen.com/english/advisories/2009/0702Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/49201Third Party Advisory, VDB Entry
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5336Third Party Advisory

Published

Mar 14, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-0137Multiple unspecified vulnerabilities in Safari RSS in Apple …
• CVE-2009-0138servermgrd (Server Manager) in Apple Mac OS X 10.5.6 does no…
• CVE-2009-0139Integer overflow in the SMB component in Apple Mac OS X 10.5…
• CVE-2009-0140Unspecified vulnerability in the SMB component in Apple Mac …
• CVE-2009-0141XTerm in Apple Mac OS X 10.4.11 and 10.5.6, when used with l…5.5
• CVE-2009-0142Race condition in AFP Server in Apple Mac OS X 10.5.6 allows…
• CVE-2009-0144CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not prop…
• CVE-2009-0145CoreGraphics in Apple Mac OS X 10.4.11 and 10.5 before 10.5.…
• CVE-2009-0146Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02p…
• CVE-2009-0147Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02…
• CVE-2009-0148Multiple buffer overflows in Cscope before 15.7a allow remot…
• CVE-2009-0149Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows local u…