Brief Hands-On Report--Apple iTunes 4.8 with Security Update & Full Screen QuickTime Video

Apple released a newer version of iTunes, version 4.8. It is not available from the System Preferences Software Update pane as of publication time but is available for download from this Apple Web page. So what's new in iTunes 4.8? From the ReadMe file dated March 23, 2005:

iTunes 4.8 includes new Music Store features and support for transferring contacts and calendars from your computer to your iPod (requires Mac OS X version 10.4 on your computer).

System requirements: iTunes 4.8 requires Mac OS X version 10.2.8 or later (Mac OS X version 10.3.8 or later is recommended). AirPort Express with AirTunes requires Mac OS X version 10.3 or later, a compatible stereo system or powered speakers, and Internet access (fees may apply). Some ISPs are not currently compatible with Airport Express.  For more information see [this Apple Web page].

iTunes 4.8 also delivers the following security improvement:

CVE-ID: CAN-2005-1248

Impact: A buffer overflow in iTunes could cause a denial of service and lead to execution of arbitrary code

Description: The MPEG4 file parsing code in iTunes versions prior to 4.8 contains a buffer overflow vulnerability. Parsing a maliciously-crafted MPEG4 file could cause iTunes to terminate or potentially execute arbitrary code. iTunes 4.8 addresses this issue by improving the validation checks used when loading MPEG4 files. Credit to Mark Litchfield of NGS Software for reporting this issue.

We downloaded and installed iTunes v4.8 and ran into no problems.

As we were first to note in yesterday's edition (actually the evening before), QuickTime full screen video plays through iTunes via the iTunes Music Store. iTunes 4.8 Preferences has a popup menu under "Advanced" that allows one to choose how video plays through iTunes (same window, new window or full screen). If you go to the iTunes Music Store's Movie Trailers section, there is a special section "Exclusive Movie Trailers" on the right that has movie trailers with the full screen option. iTunes 4.8 also has a new button at the right end the lower left row that plays full screen QuickTime movies dropped into its window. [Bill Fox & Dana Baggett]