PT-2010-1864 · Apple · Time Capsule+2

Sabahattin Gucukoglu · Published 2010-12-22 · Updated 2011-01-19 · CVE-2010-0039

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station versions prior to 7.5.2

Description The issue allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by leveraging write access to an intranet FTP server. This is due to the Application-Level Gateway (ALG) modifying PORT commands in incoming FTP traffic.

Recommendations For Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station versions prior to 7.5.2, update the firmware to version 7.5.2 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0039

Affected Products

Airport Express Base Station

Airport Extreme Base Station

Time Capsule

References · 4

• http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html · Vendor Advisory
• http://support.apple.com/kb/HT4298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0039 · Security Note
• http://securitytracker.com/id?1024907 · Note