|
Brought to you by:
Suppliers of:
|
|
|
| |
| Apple's AirPort device is a wireless access point, providing 802.11 services to network clients. Authentication credentials are obfuscated, and then sent over the network. If an AirPort is administered over the Ethernet interface or via an insecure (non-WEP) wireless connection, an attacker that can sniff the network can obtain administrative access to the AirPort. |
| |
Credit:
The original advisory can be downloaded from:
http://www.atstake.com/research/advisories/2003/a051203-1.txt
The information has been provided by at stake AdvisoriesJeremy Rauch and Dave G..
|
| |
Vulnerable systems:
* AirPort Base Station (ALL)
Apple's AirPort device is a wireless access point, providing 802.11 services to network clients. This device is managed through a proprietary administrative protocol over a TCP port (5009/tcp). Authentication credentials are obfuscated, and then sent over the network.
The authentication credentials, a password with a maximum length of 32 characters, are XOR'd against a predefined key. When sent over the network, the password is sent out in a 32 byte fixed block. @stake was able to determine the key by setting a one-character password and monitoring the network traffic. This revealed 31 bytes of the XOR 'key'. The final byte can be obtained by XORing the obfuscated first byte against the first character of the plaintext password.
If an AirPort is administered over the Ethernet interface or via an insecure (non-WEP) wireless connection, an anonymous attacker that can sniff the network can obtain administrative access to the AirPort. If WEP is enabled, then the attack is limited to WEP authenticated attackers.
Vendor Response:
The recommendation is to administer the AirPort Base Station either via a wired connection or via a WEP-protected wireless connection.
Recommendation:
The only way to securely administer the AirPort Base Station is by connecting to it via a crossover cable. In environments where this is not practical, it is advised that the AirPort Base Station be managed through the Ethernet network, and not the wireless network.
|
|
|
|
|
