{"enchantments": {"vulnersScore": 7.5}, "reporter": "CERT", "id": "VU:563492", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "published": "2006-09-22T00:00:00", "history": [], "description": "### Overview\n\nAn integer overflow exists in the Apple AirPort wireless drivers. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code, or create a denial-of-service condition.\n\n### Description\n\nAccording to Apple, \n\n_An integer overflow exists in the AirPort wireless driver's API for third-party wireless software. This could lead to a buffer overflow in such applications dependent upon API usage._\n\nNote that the attacker needs to have 802.11 wireless connectivity to the vulnerable system to exploit this vulnerability. If successfully exploited, an attacker may be able to execute arbitrary code with user-level privileges. \n \nIt is important to note that because the vulnerability exists at a lower network layer than TCP/IP, software firewalls, anti-virus software, and host-based IDS or IPS systems may not protect against this vulnerability. \n \nFor information on affected versions of OS X refer to Apple Security Update [2006-005](<http://docs.info.apple.com/article.html?artnum=304420>). \n \n--- \n \n### Impact\n\nAn unauthenticated remote attacker may be able to execute arbitrary code with the privileges of the user running an application using the affected API or cause that application to crash. \n \n--- \n \n### Solution\n\n**Apply updates from Apple** \nApple has released updates to address this issue. See Apple Security Update [2006-005](<http://docs.info.apple.com/article.html?artnum=304420>) for more details. \n \n--- \n \n \n**Disable the Affected Wireless Adapter** \n \nTurning off the wireless adapter can mitigate this vulnerability. To turn off the wireless card, follow the instructions found in [Apple's Knowledgebase](<http://docs.info.apple.com/article.html?artnum=166645>)[](<ftp://download.intel.com/support/wireless/wlan/sb/3945abgug.pdf>): \n \n`Turning AirPort off`\n\n`Turn your AirPort Card off when you're in situations where radio communication may be prohibited, such as in an airplane or at a hospital. ` \n`1. Open the Internet Connect application and click AirPort in the toolbar. ` \n`2. Click Turn AirPort Off.`\n\n`If you have disabled the AirPort port in Network preferences, then your AirPort Card is already turned off. To disable the AirPort port, choose Network Port Configurations from the Show pop-up menu and deselect the AirPort checkbox.` \n \n--- \n \n### Systems Affected \n\nVendor| Status| Date Notified| Date Updated \n---|---|---|--- \nApple Computer, Inc.| | -| 22 Sep 2006 \nIf you are a vendor and your product is affected, [let us know](<mailto:cert@cert.org?Subject=VU%23563492 Vendor Status Inquiry>).\n\n### CVSS Metrics \n\nGroup | Score | Vector \n---|---|--- \nBase | N/A | N/A \nTemporal | N/A | N/A \nEnvironmental | N/A | N/A \n \n### References\n\n * <http://lists.apple.com/archives/Security-announce/2006/Sep/msg00001.html>\n * <http://docs.info.apple.com/article.html?artnum=304420>\n\n### Credit\n\nThis vulnerability was reported in Apple Security Update [2006-005](<http://docs.info.apple.com/article.html?artnum=304420>).\n\nThis document was written by Ryan Giobbi.\n\n### Other Information\n\n * CVE IDs: [CVE-2006-3509](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3509>)\n * Date Public: 21 Sep 2006\n * Date First Published: 22 Sep 2006\n * Date Last Updated: 01 Nov 2006\n * Severity Metric: 21.94\n * Document Revision: 44\n\n", "bulletinFamily": "info", "viewCount": 0, "cvelist": ["CVE-2006-3509", "CVE-2006-3509"], "type": "cert", "hash": "2f342143cd23b71dd5c71bf84bd4b34b83b7d0ef348bab62aa86bf7eb64b5d09", "references": ["http://docs.info.apple.com/article.html?artnum=304420", "http://docs.info.apple.com/article.html?artnum=304420", "http://docs.info.apple.com/article.html?artnum=304420", "http://docs.info.apple.com/article.html?artnum=304420", "http://lists.apple.com/archives/Security-announce/2006/Sep/msg00001.html", "http://docs.info.apple.com/article.html?artnum=166645", "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3509"], "title": "Apple AirPort wireless drivers vulnerable to integer overflow", "href": "https://www.kb.cert.org/vuls/id/563492", "lastseen": "2016-02-03T09:12:53", "edition": 1, "objectVersion": "1.2", "modified": "2006-11-01T00:00:00"}

{"result": {"cve": [{"id": "CVE-2006-3509", "type": "cve", "title": "CVE-2006-3509", "description": "Integer overflow in the API for the AirPort wireless driver on Apple Mac OS X 10.4.7 might allow physically proximate attackers to cause a denial of service (crash) or execute arbitrary code in third-party wireless software that uses the API via crafted frames.", "published": "2006-09-21T17:07:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3509", "cvelist": ["CVE-2006-3509"], "lastseen": "2016-09-03T07:13:39"}], "osvdb": [{"id": "OSVDB:29063", "type": "osvdb", "title": "Apple Airport Wireless Driver API Crafted Frame Overflow", "description": "# No description provided by the source\n\n## References:\n[Vendor Specific Advisory URL](http://docs.info.apple.com/article.html?artnum=304420)\n[Secunia Advisory ID:22068](https://secuniaresearch.flexerasoftware.com/advisories/22068/)\n[Related OSVDB ID: 29061](https://vulners.com/osvdb/OSVDB:29061)\n[Related OSVDB ID: 29062](https://vulners.com/osvdb/OSVDB:29062)\n[CVE-2006-3509](https://vulners.com/cve/CVE-2006-3509)\n", "published": "2006-09-19T07:49:11", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/osvdb/OSVDB:29063", "cvelist": ["CVE-2006-3509"], "lastseen": "2017-04-28T13:20:25"}], "nessus": [{"id": "MACOSX_AIRPORT_2006-001.NASL", "type": "nessus", "title": "AirPort Update 2006-001 / Security Update 2006-005", "description": "The remote host is missing a security update regarding the drivers of the AirPort wireless card.\n\nAn attacker in the proximity of the target host may exploit this flaw by sending malformed 802.11 frames to the remote host and cause a stack overflow resulting in a crash of arbitrary code execution.", "published": "2006-09-21T00:00:00", "cvss": {"score": 7.2, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=22418", "cvelist": ["CVE-2006-3508", "CVE-2006-3509", "CVE-2006-3507"], "lastseen": "2018-07-15T04:12:00"}]}}