Lucene search

[email protected]CVE-2010-0962

HistoryMar 10, 2010 - 10:30 p.m.

CVE-2010-0962

2010-03-1022:30:00

CWE-264

[email protected]

web.nvd.nist.gov

apple

airport express

airport extreme

time capsule

ftp

proxy server

ip address

port

port command

remote attackers

intranet

tcp forwarding

cve-2010-0962

nvd

7.3 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.01 Low

EPSS

Percentile

84.0%

JSON

The FTP proxy server in Apple AirPort Express, AirPort Extreme, and Time Capsule with firmware 7.5 does not restrict the IP address and port specified in a PORT command from a client, which allows remote attackers to leverage intranet FTP servers for arbitrary TCP forwarding via a crafted PORT command.

CPENameOperatorVersion
apple:time_capsuleapple time capsuleeq7.5
apple:airport_extremeapple airport extremeeq7.5
apple:airport_expressapple airport expresseq7.5

CPE	Name	Operator	Version
apple:time_capsule	apple time capsule	eq	7.5
apple:airport_extreme	apple airport extreme	eq	7.5
apple:airport_express	apple airport express	eq	7.5

References

seclists.org/fulldisclosure/2010/Mar/106

www.securityfocus.com/archive/1/509867/100/0/threaded

www.securityfocus.com/archive/1/509974/100/0/threaded

www.securityfocus.com/bid/38543

exchange.xforce.ibmcloud.com/vulnerabilities/56701

7.3 High

AI Score

Confidence

Low

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.01 Low

EPSS

Percentile

84.0%

JSON

Related for CVE-2010-0962

cvelist1 prion1