iTunes 8.1 fixes two vulnerabilities

Apple updated iTunes to version 8.1 and in the process addressed two vulnerabilities outlined below.

Sending a maliciously crafted DAAP message may lead to a denial of service
Available for: Windows XP or Vista

An infinite loop exists in the handling of iTunes Digital Audio Access Protocol (DAAP) messages. Sending a message containing a maliciously crafted Content-Length parameter in the DAAP header may lead to a denial of service. This update addresses the issue by performing additional validation of DAAP messages. This issue does not affect Mac OS X systems.

Subscribing to a malicious podcast may lead to the disclosure of iTunes username and password
Available for: Mac OS X v10.4.10 or later, Mac OS X Server v10.4.10 or later, Windows XP or Vista

A design issue exists in the iTunes podcast feature. A subscription to a malicious podcast may cause an authentication dialog to be presented to the user. This dialog may entice the user to send iTunes credentials to the podcast server. This update addresses the issue by clarifying the origin of the authentication request in the dialog.