Apple AirPort Base Station Authentication Credential Encryption Weakness

high Nessus Plugin ID 11620

Language:

Synopsis

The remote wireless access point contains a password encryption weakness.

Description

The remote host is an Apple Airport Wireless Access Point which can be administrated on top of TCP port 5009.

There is a design flaw in the administrative protocol which makes the clients which connect to this port send the password in cleartext (although slightly obsfuscated).

An attacker who has the ability to sniff the data going to this device may use this flaw to gain its administrative password and gain its control. Since the airport base station does not keep any log, it will be difficult to determine that administrative access has been stolen.

Solution

Block incoming traffic to this port, and only administer this base station when connected to it using a cross-over ethernet cable.

Plugin Details

Severity: High

ID: 11620

File Name: airport_plaintext_credentials.nasl

Version: 1.20

Type: Remote

Family: Misc.

Published: 5/12/2003

Updated: 4/11/2022

Configuration: Enable thorough checks (optional)

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2003-0270

Vulnerability Information

CPE: cpe:/h:apple:802.11n

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 5/12/2003

Reference Information

CVE: CVE-2003-0270

BID: 7554

SECUNIA: 8773

Detections

Analytics