(Apple Issues Fix for AirPort Base Station) FreeBSD ICMPv6 Processing Flaw Lets Remote Users Deny Service
|
|
SecurityTracker Alert ID: 1021814 |
|
SecurityTracker URL: http://securitytracker.com/id/1021814
|
|
CVE Reference:
CVE-2008-3530
(Links to External Site)
|
Date: Mar 6 2009
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): firmware prior to 7.4.1
|
Description:
A vulnerability was reported in the FreeBSD kernel's IPv6 stack. A remote user can cause denial of service conditions. Apple AirPort Base Station is affected.
A remote user can send a specially crafted ICMPv6 'Packet Too Big Message' to trigger a kernel panic.
Systems configured to process IPv6 packets that have active IPv6 TCP sockets are affected.
Tom Parker and Bjoern A. Zeeb reported this vulnerability.
|
Impact:
A remote user can cause the target system to crash.
|
Solution:
Apple has released a fix (firmware 7.4.1) for AirPort Base Station, which is affected by this vulnerability.
The Apple advisory is available at:
http://support.apple.com/kb/HT3467
|
Cause:
Input validation error
|
Underlying OS:
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 5 Mar 2009 18:25:59 -0800
Subject: APPLE-SA-2009-03-05 Time Capsule and AirPort Base Station
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
APPLE-SA-2009-03-05 Time Capsule and AirPort Base Station (802.11n*)
Firmware 7.4.1
Time Capsule and AirPort Base Station (802.11n*) Firmware 7.4.1 is
now available and addresses the following:
CVE-ID: CVE-2008-2476
Available for: AirPort Extreme Base Station with 802.11n*,
AirPort Express Base Station with 802.11n*, Time Capsule
Impact: A remote user may be able to cause a denial of service
attack, observe private network traffic, or inject forged packets
Description: The IPv6 Neighbor Discovery Protocol implementation
does not validate the origin of Neighbor Discovery messages. By
sending a maliciously crafted message, a remote user may cause a
denial of service, observe private network traffic, or inject forged
packets. This update addresses the issue by performing additional
validation of Neighbor Discovery messages.
CVE-ID: CVE-2008-0473
Available for: AirPort Extreme Base Station with 802.11n*,
AirPort Express Base Station with 802.11n*, Time Capsule
Impact: A user on the local network may be able to cause an
unexpected device shutdown
Description: An out-of-bounds memory access issue exists in the
handling of PPPoE discovery packets. By sending a maliciously crafted
PPPoE discovery packet, a remote user may be able to cause an
unexpected device shutdown. This update addresses the issue
through improved bounds checking.
CVE-ID: CVE-2008-3530
Available for: AirPort Extreme Base Station with 802.11n*,
AirPort Express Base Station with 802.11n*, Time Capsule
Impact: A remote user may be able to cause an unexpected device
shutdown
Description: When IPv6 support is enabled, IPv6 nodes use ICMPv6 to
report errors encountered while processing packets. An implementation
issue in the handling of incoming ICMPv6 "Packet Too Big" messages
may cause an unexpected device shutdown. This update addresses
the issue through improved handling of ICMPv6 messages.
Installation note for Firmware version 7.4.1
Firmware version 7.4.1 is installed into Time Capsule or AirPort
Base Station with 802.11n* via AirPort Utility, provided with
the device.
It is recommended that AirPort Utility 5.4.1 be installed before
upgrading to Firmware version 7.4.1.
AirPort Utility 5.4.1 may be obtained through Apple's Software
Download site: http://www.apple.com/support/downloads/
(*) Based on an IEEE 802.11n draft specification
Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.9 (Darwin)
iQEcBAEBAgAGBQJJrzcMAAoJEHkodeiKZIkBs5UIALDK3nyGyd/9VKlhhbyxARTs
2Q2FW/nQTqst90gqJDXVmn6X3iqP7Za9wq2gUPSjOsyMz4hEQxJe3RTmwQDp21lI
fDnW+qbHMgK+kJ4i7c5ZX1FfaRuETPX5nurqKvpRmEJDP2SshWgjaDcw8VE9JBty
ypfyOsq+Xmp84IjhGaokw4Ug/EPj6aOF4yT8OPcsAE6GwPBlg9chZvLelAVkOcCE
/+CUIb9o5OjLBXjyepL05clkUXGULzBcOGAcB6At6WlwzWr/QEIPWliWDbEYeo6X
Y8FlrMXvW9+rWuv95qF6vEGfh0VtV1BveKAZPMVoLcW0jI5zHYh7GBkhjcS0F98=
=chDp
-----END PGP SIGNATURE-----
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Security-announce mailing list (Security-announce@lists.apple.com)
|
|
