AirPort Extreme Update 2007-002 is now available. It contains the
content of AirPort Extreme Update 2007-001 plus an additional
non-security fix for a compatibility issue when using certain
third-party access points configured to use WEP. AirPort Extreme
Update 2007-001 contained a fix for the following security issue:
AirPort
CVE-ID: CVE-2006-6292
Available for: Mac OS X v10.4.8, Mac OS X Server v10.4.8
Impact: Attackers on the wireless network may cause system
crashes
Description: An out-of-bounds memory read may occur while
handling wireless frames. An attacker in local proximity may be
able to trigger a system crash by sending a maliciously-crafted
frame to an affected system. This issue affects the Core Duo
version of Mac mini, MacBook, and MacBook Pro computers equipped
with wireless. Other systems, including the Core 2 Duo versions
are not affected. This update addresses the issue by performing
additional validation of wireless frames. Credit to LMH for
reporting this issue.
Systems which installed AirPort Extreme Update 2007-001 are correctly
patched for CVE-2006-6292. Installing AirPort Extreme Update
2007-002 is recommended to obtain the compatibility fix. Affected
systems that have not yet applied AirPort Extreme Update 2007-001
should apply AirPort Extreme Update 2007-002.
AirPort Extreme Update 2007-002 may be obtained from the Software
Update pane in System Preferences, or Apple's Software Downloads web
site: http://www.apple.com/support/downloads/
The download file is named: "AirPortExtremeUpdate2007002.dmg"
Its SHA-1 digest is: ba20b5807dd99308ca2431c2e9a2b4e1b93bcbd1
