Unscored severity · published Dec 22, 2010
CVE-2010-0039
The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in…
–
CVSS
1.7%
EPSS
No
On KEV
Description
The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by leveraging write access to an intranet FTP server.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Airport Express · Apple
All versions, or not specified · source: NVD
AE
Airport Express Base Station Firmware · Apple
through 7.4.2; 3.84; 4.0.9; 6.1; 6.3; 7.3.2; +1 more · source: NVD
AE
Airport Extreme · Apple
All versions, or not specified · source: NVD
AE
Airport Extreme Base Station Firmware · Apple
5.5; 5.7 · source: NVD
TC
Time Capsule · Apple
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-0039
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-0039
Patch
http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html
Patch
http://support.apple.com/kb/HT4298
www.securitytracker.com
http://www.securitytracker.com/id?1024907
More from Airport Express
–
CVE-2009-2189
The ICMPv6 implementation on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 does not limit the rate of (1)…
–
CVE-2010-1804
Unspecified vulnerability in the network bridge functionality on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2…
–
CVE-2010-0962
The FTP proxy server in Apple AirPort Express, AirPort Extreme, and Time Capsule with firmware 7.5 does not restrict the IP address and port specified in a PORT command from a…
–
CVE-2005-3714
The network interface for Apple AirPort Express 6.x before Firmware Update 6.3, and AirPort Extreme 5.x before Firmware Update 5.7, allows remote attackers to cause a denial of…
–
CVE-2005-0289
Apple AirPort Express prior to 6.1.1 and Extreme prior to 5.5.1, configured as a Wireless Data Service (WDS), allows remote attackers to cause a denial of service (device freeze)…