PT-2010-2685 · Apple · Airport Express+2

Sabahattin Gucukoglu · Published 2010-03-10 · Updated 2018-10-10 · CVE-2010-0962

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apple AirPort Express, AirPort Extreme, and Time Capsule version 7.5

Description The issue concerns the FTP proxy server, which does not properly restrict IP addresses and ports specified in a PORT command from a client. This allows remote attackers to use intranet FTP servers for arbitrary TCP forwarding by crafting a PORT command.

Recommendations For Apple AirPort Express, AirPort Extreme, and Time Capsule version 7.5, consider restricting access to the FTP proxy server until a fix is available. As a temporary workaround, restrict the use of the PORT command to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0962

Affected Products

Airport Express

Airport Extreme

Time Capsule

References · 6

• 🔥 http://securityfocus.com/bid/38543 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-0962 · Security Note
• http://securityfocus.com/archive/1/509974/100/0/threaded · Note
• http://securityfocus.com/archive/1/509867/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2010/Mar/106 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56701 · Note