AOH :: HP Unsorted T :: TB10842.HTM

TFTPdWin 0.4.2 Server Directory Traversal Vulnerability



TFTPdWin 0.4.2 Server Directory Traversal Vulnerability
TFTPdWin 0.4.2 Server Directory Traversal Vulnerability



Title
-----
TFTPdWin 0.4.2 Server Directory Traversal Vulnerability

Severity
--------
High

Date Discovered
---------------
3/15/2007

Vendor Notified
---------------
3/26/2007  -  No Response

Discovered By
-------------
Digital Defense, Inc. Vulnerability Research Team
 - r@b13s

Vulnerability Description
-------------------------
The version of TFTPdWin contains a vulnerability that allows a potential intruder to gain read and write access to directories and files outside of the TFTP root.  Successful exploitation of this vulnerability may also allow a remote, unauthenticated attacker to overwrite and modify system files which could facilitate the execution of arbitrary code, the result of which could ultimately lead to a full system compromise.  

Solution Description
--------------------
No patch is available at this time.  Other versions may be vulnerable.


Tested Systems / Software (with versions)
-----------------------------------------
Windows XP Professional Service Pack 2, TFTPdWin version 0.4.2

Vendor Website
--------------
http://www.prosysinfo.webpark.pl/ 

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.