If he downloaded it from iTunes, then it has DRM in it that should prevent you from listening to it.

If he ripped it from his own CD then it might not have DRM in it.

If it's the first case, then it's technically illegal to break that DRM. If it's the second, there might be m4a converters out on the web, though I don't know of any.