CVE-2010-0039

Apple AirPort Base Station Firmware < 7.5.2 - FTP PORT Command Traffic Redirection

Title source: llm

Description

The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in incoming FTP traffic, which allows remote attackers to use the device's IP address for arbitrary intranet TCP traffic by leveraging write access to an intranet FTP server.

References (3)

Core 3

Core References

Patch, Vendor Advisory vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html

Patch, Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT4298

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id?1024907

Scores

EPSS 0.0172

EPSS Percentile 75.1%

Details

CWE

CWE-264

Status published

Products (12)

apple/airport_express

apple/airport_express_base_station_firmware 3.84

apple/airport_express_base_station_firmware 4.0.9

apple/airport_express_base_station_firmware 6.1

apple/airport_express_base_station_firmware 6.3

apple/airport_express_base_station_firmware 7.3.2

apple/airport_express_base_station_firmware 7.4.1

apple/airport_express_base_station_firmware < 7.4.2

apple/airport_extreme

apple/airport_extreme_base_station_firmware 5.5

... and 2 more

Published Dec 22, 2010

Tracked Since Feb 18, 2026