Sign-up

ID

VAR-201012-0014


CVE

CVE-2010-0039


TITLE

plural Apple Run on product Application-Level Gateway Of devices in IP Address used vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2010-002657

DESCRIPTION

The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by leveraging write access to an intranet FTP server. Apple Time Capsule is a solution that allows Macs and PCs to back up data over a wireless network. AirPort Base Station is a wireless base station. Since the data is retransmitted from the base station, it is possible to bypass some IP-based services. NOTE: This issue was previously discussed in BID 45466 (Apple Time Capsule and AirPort Base Station Multiple Remote Vulnerabilities) but has been given its own record to better document it. Time Capsule is a backup tool developed by Apple, specially designed for Time Machine of Mac system. By sending a maliciously crafted SNMPv3 packet, an attacker may cause the SNMP server to terminate, denying service to legitimate clients. By default, the 'WAN SNMP' configuration option is disabled, and the SNMP service is accessible only to other devices on the local network. This issue is addressed by applying the Net-SNMP patches. CVE-ID: CVE-2009-2189 Available for: AirPort Extreme Base Station with 802.11n, AirPort Express Base Station with 802.11n, Time Capsule Impact: Receiving a large number of IPv6 Router Advertisement (RA) and Neighbor Discovery (ND) packets from a system on the local network may cause the base station to restart Description: A resource consumption issue exists in the base station's handling of Router Advertisement (RA) and Neighbor Discovery (ND) packets. A system on the local network may send a large number of RA and ND packets that could exhaust the base station's resources, causing it to restart unexpectedly. This issue is addressed by rate limiting incoming ICMPv6 packets. Credit to Shoichi Sakane of the KAME project, Kanai Akira of Internet Multifeed Co., Shirahata Shin and Rodney Van Meter of Keio University, and Tatuya Jinmei of Internet Systems Consortium, Inc. for reporting this issue. This issue is addressed by not rewriting inbound PORT commands via the ALG. Credit to Sabahattin Gucukoglu for reporting this issue. This issue is addressed through improved validation of fragmented ISAKMP packets. Sending a maliciously crafted DHCP reply to the device may cause it to stop responding to network traffic. This issue affects devices that have been configured to act as a bridge, or are configured in Network Address Translation (NAT) mode with a default host enabled. By default, the device operates in NAT mode, and no default host is configured. This update addresses the issue through improved handling of DHCP packets on the network bridge. Credit to Stefan R. Filipek for reporting this issue. It is recommended that AirPort Utility 5.5.2 be installed before upgrading to Firmware version 7.5.2. AirPort Utility 5.5.2 may be obtained through Apple's Software Download site: http://www.apple.com/support/downloads/ Information will also be posted to the Apple Security Updates web site: http://support.apple.com/kb/HT1222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) iQEcBAEBAgAGBQJNCWXyAAoJEGnF2JsdZQeevTQH/0856gTUzzmL371/nSkhn3qq MCPQVaEMe8O/jy96nlskwzp3X0X0QmXePok1enp6QhDhHm0YL3a4q7YHd4zjm6mM JUoVR4JJRSKOb1bVdEXqo+qG/PH7/5ywfrGas+MjOshMa3gnhYVee39N7Xtz0pHD 3ZllZRwGwad1sQLL7DhJKZ92z6t2GfHoJyK4LZNemkQAL1HyUu7Hj9SlljcVB+Ub xNnpmBXJcCZzp4nRQM+fbLf6bdZ1ua5DTc1pXC8vETtxyHc53G/vLCu8SKBnTBlK JmkpGwG5fXNuYLL8ArFUuEu3zhE7kfdeftUrEez3YeL2DgU9iB8m8RkuuSrVJEY= =WPH8 -----END PGP SIGNATURE----- . ---------------------------------------------------------------------- Secure your corporate defenses and reduce complexity in handling vulnerability threats with the new Secunia Vulnerability Intelligence Manager (VIM). Request a free trial: http://secunia.com/products/corporate/vim/ ---------------------------------------------------------------------- TITLE: Apple AirPort / Time Capsule Multiple Vulnerabilities SECUNIA ADVISORY ID: SA42665 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/42665/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=42665 RELEASE DATE: 2010-12-26 DISCUSS ADVISORY: http://secunia.com/advisories/42665/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/42665/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=42665 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Multiple vulnerabilities have been reported in Apple Airport Extreme and Time Capsule, which can be exploited by malicious users to bypass certain security restrictions and by malicious people to cause a DoS (Denial of Service). 1) An error when handling SNMP requests can be exploited to cause a crash. 4) An error when handling fragmented ISAKMP packets can be exploited to cause a crash of the racoon daemon. SOLUTION: Update to firmware version 7.5.2 (please see the vendor's advisory for details). 3) Sabahattin Gucukoglu. ORIGINAL ADVISORY: Apple: http://support.apple.com/kb/HT4298 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.7

sources: NVD: CVE-2010-0039 // JVNDB: JVNDB-2010-002657 // CNVD: CNVD-2010-3274 // BID: 45489 // VULHUB: VHN-42644 // PACKETSTORM: 96766 // PACKETSTORM: 97034

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2010-3274

AFFECTED PRODUCTS

vendor:applemodel:airport express base stationscope:eqversion:7.4.1

Trust: 1.6

vendor:applemodel:airport express base stationscope:eqversion:6.1

Trust: 1.6

vendor:applemodel:airport express base stationscope:eqversion:3.84

Trust: 1.6

vendor:applemodel:airport express base stationscope:eqversion:4.0.9

Trust: 1.6

vendor:applemodel:airport extreme base stationscope:eqversion:5.7

Trust: 1.6

vendor:applemodel:airport extreme base stationscope:eqversion:5.5

Trust: 1.6

vendor:applemodel:airport express base stationscope:eqversion:7.3.2

Trust: 1.6

vendor:applemodel:airport express base stationscope:eqversion:6.3

Trust: 1.6

vendor:applemodel:time capsulescope: - version: -

Trust: 1.4

vendor:applemodel:airport expressscope:eqversion:*

Trust: 1.0

vendor:applemodel:time capsulescope:eqversion:*

Trust: 1.0

vendor:applemodel:airport extremescope:eqversion:*

Trust: 1.0

vendor:applemodel:airport express base stationscope:lteversion:7.4.2

Trust: 1.0

vendor:applemodel:time capsulescope:eqversion:7.4.1

Trust: 0.9

vendor:applemodel:time capsulescope:eqversion:7.4.2

Trust: 0.9

vendor:applemodel:time capsulescope:eqversion:7.5

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:7.0

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:7.1

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:7.5

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:5.5

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:5.7

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:7.2.1

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:7.3.1

Trust: 0.9

vendor:applemodel:airport extremescope:eqversion:7.4.2

Trust: 0.9

vendor:applemodel:airport extreme base station with 802.11nscope:eqversion:7.4.1

Trust: 0.9

vendor:applemodel:airmac expressscope:eqversion:base station (802.11n)

Trust: 0.8

vendor:applemodel:airmac extremescope:eqversion:base station (802.11n)

Trust: 0.8

vendor:applemodel:airport extreme base stationscope: - version: -

Trust: 0.6

vendor:applemodel:airport extremescope: - version: -

Trust: 0.6

vendor:applemodel:airport express base stationscope:eqversion:7.4.2

Trust: 0.6

vendor:applemodel:time capsulescope:eqversion:0

Trust: 0.3

vendor:applemodel:airport extreme base stationscope:eqversion:0

Trust: 0.3

vendor:applemodel:airport extremescope:eqversion:5.4.1

Trust: 0.3

vendor:applemodel:airport extremescope:eqversion:5.0.4

Trust: 0.3

vendor:applemodel:airport extremescope:eqversion:5.0.3

Trust: 0.3

vendor:applemodel:airport extremescope:eqversion:5.0.1

Trust: 0.3

vendor:applemodel:airport extremescope:eqversion:5.4+

Trust: 0.3

vendor:applemodel:airport extremescope:eqversion:0

Trust: 0.3

vendor:applemodel:airport express base station with 802.11nscope:eqversion:7.4.1

Trust: 0.3

vendor:applemodel:airport expressscope:eqversion:0

Trust: 0.3

vendor:applemodel:time capsulescope:neversion:7.5.2

Trust: 0.3

vendor:applemodel:airport extreme base station with 802.11nscope:neversion:7.5.2

Trust: 0.3

vendor:applemodel:airport express base station with 802.11nscope:neversion:7.5.2

Trust: 0.3

sources: CNVD: CNVD-2010-3274 // BID: 45489 // JVNDB: JVNDB-2010-002657 // CNNVD: CNNVD-201012-270 // NVD: CVE-2010-0039

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-0039
value: LOW

Trust: 1.0

NVD: CVE-2010-0039
value: LOW

Trust: 0.8

CNNVD: CNNVD-201012-270
value: LOW

Trust: 0.6

VULHUB: VHN-42644
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2010-0039
severity: LOW
baseScore: 2.6
vectorString: AV:N/AC:H/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-42644
severity: LOW
baseScore: 2.6
vectorString: AV:N/AC:H/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 4.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-42644 // JVNDB: JVNDB-2010-002657 // CNNVD: CNNVD-201012-270 // NVD: CVE-2010-0039

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-42644 // JVNDB: JVNDB-2010-002657 // NVD: CVE-2010-0039

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201012-270

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201012-270

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2010-002657

PATCH
title:HT4298url:http://support.apple.com/kb/HT4298
Trust: 0.8
title:HT4298url:http://support.apple.com/kb/HT4298?viewlocale=ja_JP
Trust: 0.8
title:Apple Time Capsule/AirPort Base Station has patches that bypass some IP-based service security vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/2147
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2010-3274 // 
            
            
            
            JVNDB: JVNDB-2010-002657

EXTERNAL IDS
db:NVDid:CVE-2010-0039
Trust: 3.5
db:SECTRACKid:1024907
Trust: 1.9
db:JVNDBid:JVNDB-2010-002657
Trust: 0.8
db:SECUNIAid:42665
Trust: 0.7
db:CNVDid:CNVD-2010-3274
Trust: 0.6
db:APPLEid:APPLE-SA-2010-12-16-1
Trust: 0.6
db:CNNVDid:CNNVD-201012-270
Trust: 0.6
db:BIDid:45489
Trust: 0.4
db:VULHUBid:VHN-42644
Trust: 0.1
db:PACKETSTORMid:96766
Trust: 0.1
db:PACKETSTORMid:97034
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2010-3274 // 
            
            
            
            VULHUB: VHN-42644 // 
            
            
            
            BID: 45489 // 
            
            
            
            JVNDB: JVNDB-2010-002657 // 
            
            
            
            PACKETSTORM: 96766 // 
            
            
            
            PACKETSTORM: 97034 // 
            
            
            
            CNNVD: CNNVD-201012-270 // 
            
            
            
            NVD: CVE-2010-0039

REFERENCES
url:http://support.apple.com/kb/ht4298
Trust: 2.4
url:http://www.securitytracker.com/id?1024907
Trust: 1.9
url:http://lists.apple.com/archives/security-announce/2010//dec/msg00001.html
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0039
Trust: 0.8
url:http://jvn.jp/cert/jvnvu545319
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0039
Trust: 0.8
url:http://secunia.com/advisories/42665
Trust: 0.6
url:http://software.cisco.com/download/navigator.html?mdfid=283613663
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2008-4309
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2009-2189
Trust: 0.1
url:http://www.apple.com/support/downloads/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-1804
Trust: 0.1
url:https://www.apple.com/support/security/pgp/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2010-0039
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2009-1574
Trust: 0.1
url:http://support.apple.com/kb/ht1222
Trust: 0.1
url:http://secunia.com/advisories/42665/#comments
Trust: 0.1
url:http://secunia.com/products/corporate/evm/
Trust: 0.1
url:http://secunia.com/advisories/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
Trust: 0.1
url:http://secunia.com/products/corporate/vim/
Trust: 0.1
url:https://ca.secunia.com/?page=viewadvisory&vuln_id=42665
Trust: 0.1
url:http://secunia.com/vulnerability_scanning/personal/
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/advisories/42665/
Trust: 0.1
url:http://secunia.com/advisories/about_secunia_advisories/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2010-3274 // 
            
            
            
            VULHUB: VHN-42644 // 
            
            
            
            BID: 45489 // 
            
            
            
            JVNDB: JVNDB-2010-002657 // 
            
            
            
            PACKETSTORM: 96766 // 
            
            
            
            PACKETSTORM: 97034 // 
            
            
            
            CNNVD: CNNVD-201012-270 // 
            
            
            
            NVD: CVE-2010-0039

CREDITS
Sabahattin Gucukoglu
Trust: 0.3
sources:
            
            
            BID: 45489

SOURCES
db:CNVDid:CNVD-2010-3274
db:VULHUBid:VHN-42644
db:BIDid:45489
db:JVNDBid:JVNDB-2010-002657
db:PACKETSTORMid:96766
db:PACKETSTORMid:97034
db:CNNVDid:CNNVD-201012-270
db:NVDid:CVE-2010-0039

LAST UPDATE DATE
2025-04-11T19:49:29.645000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2010-3274date:2010-12-17T00:00:00
db:VULHUBid:VHN-42644date:2011-01-19T00:00:00
db:BIDid:45489date:2010-12-16T00:00:00
db:JVNDBid:JVNDB-2010-002657date:2011-01-19T00:00:00
db:CNNVDid:CNNVD-201012-270date:2010-12-23T00:00:00
db:NVDid:CVE-2010-0039date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE
db:CNVDid:CNVD-2010-3274date:2010-12-17T00:00:00
db:VULHUBid:VHN-42644date:2010-12-22T00:00:00
db:BIDid:45489date:2010-12-16T00:00:00
db:JVNDBid:JVNDB-2010-002657date:2011-01-19T00:00:00
db:PACKETSTORMid:96766date:2010-12-17T07:46:59
db:PACKETSTORMid:97034date:2010-12-26T07:30:30
db:CNNVDid:CNNVD-201012-270date:2010-12-23T00:00:00
db:NVDid:CVE-2010-0039date:2010-12-22T03:00:01.390