PT-2010-2685 · Apple · Airport Express+2

Sabahattin Gucukoglu · Publicado 2010-03-10 · Atualizado 2018-10-10 · CVE-2010-0962

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple AirPort Express, AirPort Extreme, and Time Capsule version 7.5

Description The issue concerns the FTP proxy server, which does not properly restrict IP addresses and ports specified in a PORT command from a client. This allows remote attackers to use intranet FTP servers for arbitrary TCP forwarding by crafting a PORT command.

Recommendations For Apple AirPort Express, AirPort Extreme, and Time Capsule version 7.5, consider restricting access to the FTP proxy server until a fix is available. As a temporary workaround, restrict the use of the PORT command to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-0962

Produtos afetados

Airport Express

Airport Extreme

Time Capsule

Referências · 6

• 🔥 http://securityfocus.com/bid/38543 · Exploit
• http://securityfocus.com/archive/1/509974/100/0/threaded · Nota
• http://securityfocus.com/archive/1/509867/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0962 · Nota de Segurança
• http://seclists.org/fulldisclosure/2010/Mar/106 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56701 · Nota