After the installation, the first user to run the iTunes application can delete the SC Info folder, create a link to the Windows system folder, and re-create the folder by forcing an MSI repair, which can be later used to gain Windows SYSTEM level access.”

“The iTunes application creates a folder, SC Info, in the C:ProgramDataApple ComputeriTunes directory as a system user and gives full control over this directory to all users. The flaw was uncovered by Zeeshan Shaikh of the Synopsys Cybersecurity Research Center (CyRC), which published some details on the problem after Apple released iTunes 12.12.9 to patch the issue. While the process for exploiting this was a bit convoluted, it was still an open door that potential malware could take advantage of. Sadly, that legacy also includes many of the security problems that Windows apps can fall victim to.Įarlier this week, researchers discovered a perfect storm of vulnerabilities that could turn iTunes for Windows into a serious security risk. Although Apple retired iTunes for Mac in 2019 with the release of macOS Catalina, its legacy lives on for Windows users.

Update itunes on pc