Vulnerability CVE-2010-0039


Published: 2010-12-21   Modified: 2012-02-13

Description:
The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by leveraging write access to an intranet FTP server.

Type:

CWE-264

(Permissions, Privileges, and Access Controls)

Vendor: Apple
Product: Airport express base station firmware 
Version:
7.4.2
7.4.1
7.3.2
6.3
6.1
4.0.9
3.84
Product: Airport extreme base station firmware 
Version: 5.7; 5.5;
Product: Airport express 
Product: Time capsule 
Product: Airport extreme 

CVSS2 => (AV:N/AC:H/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.6/10
2.9/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://support.apple.com/kb/HT4298
http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html
http://www.securitytracker.com/id?1024907

Related CVE
CVE-2018-4298
In macOS High Sierra before 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan, a permissions issue existed in Remote Management. This issue was addressed through improved permission validation.
CVE-2018-4278
In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tr...
CVE-2018-4277
In iOS before 11.4.1, watchOS before 4.3.2, tvOS before 11.4.1, Safari before 11.1.1, macOS High Sierra before 10.13.6, a spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation.
CVE-2018-4262
In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issues were addressed with improved memory handling.
CVE-2018-4258
In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved bounds checking.
CVE-2018-4257
In macOS High Sierra before 10.13.5, a buffer overflow was addressed with improved size validation.
CVE-2018-4256
In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.
CVE-2018-4255
In macOS High Sierra before 10.13.5, an out-of-bounds read was addressed with improved input validation.

Copyright 2019, cxsecurity.com

 

Back to Top