Apple issues iTunes update to close man-in-the-middle hole

Apple on Monday released an updated version of its iTunes program to close a vulnerability that could lead to a man-in-the-middle attack. Version 10.5.1 contains a fix for a flaw that could permit an attacker to "offer software that appears to originate from Apple" when users are prompted to install an iTunes update but don't have Software Update for Windows installed, according to an advisory. "[C]licking the 'Download iTunes' button may open the URL from the HTTP response in the user's default browser," the advisory said, at which time an attacker theoretically could pass malicious content to the user.