Apple Airport Driver Remote Code Execution Vulnerability

Bugtraq ID:	20862
Class:	Design Error
CVE:	CVE-2006-5710
Remote:	Yes
Local:	No
Published:	Nov 01 2006 12:00AM
Updated:	Nov 29 2006 10:00PM
Credit:	HD Moore is credited with discovering this issue.
Vulnerable:	Apple Orinoco Airport Driver 0
Not Vulnerable:

Apple Airport Driver Remote Code Execution Vulnerability

Apple AirPort driver is prone to a vulnerability that could allow remote arbitrary code execution with kernel-level privileges.

Successful exploits may allow remote attackers to execute arbitrary machine code, resulting in a complete compromise of affected computers. Failed exploit attempts will likely result in denial-of-service conditions.

This issue affects the eMac, iBook, iMac, PowerBook G3, PowerBook G4, and Power Mac G4 computers which were equipped with an original AirPort card. Computers with an AirPort Extreme are not affected.

Apple Airport Driver Remote Code Execution Vulnerability

The following proof-of-concept Metasploit module is available:

• /data/vulnerabilities/exploits/daringphucball.rb

Apple Airport Driver Remote Code Execution Vulnerability

Solution:
Apple has released a fix to address this issue. Please see the referenced advisory for information on how to obtain and apply the fix.

Apple Airport Driver Remote Code Execution Vulnerability

References:

• Apple flaw kicks off second month of bugs (Robert Lemos)
  
• Cisco TelePresence Video Communication Server (VCS) Homepage (Cisco)
  
• Exploit Released for Unpatched Apple Wi-Fi Flaw (Brian Krebs)
  
• MOKB-01-11-2006 (HD Moore)