FutureSoft TFTP Server 2000 Multiple Remote Vulnerabilities
BID:13821
Info
FutureSoft TFTP Server 2000 Multiple Remote Vulnerabilities
| Bugtraq ID: | 13821 |
| Class: | Unknown |
| CVE: |
CVE-2005-1812 CVE-2005-1813 |
| Remote: | Yes |
| Local: | No |
| Published: | May 31 2005 12:00AM |
| Updated: | Dec 04 2008 01:21AM |
| Credit: | Discovery is credited to Tan Chew Keong. |
| Vulnerable: |
FutureSoft TFTP Server 2000 1.0 .0.1 |
| Not Vulnerable: | |
Discussion
FutureSoft TFTP Server 2000 Multiple Remote Vulnerabilities
FutureSoft TFTP Server 2000 is affected by multiple remote vulnerabilities. Exploiting these issues can allow an attacker to retrieve arbitrary files and carry out buffer-overflow attacks.
The following specific issues were identified:
- Multiple buffer overflow vulnerabilities. A successful attack may allow the attacker to execute arbitrary code on a vulnerable computer and gain unauthorized access in the context of the server. A denial-of-service condition may arise as well.
- A directory-traversal vulnerability. A successful attack may allow the attacker to access arbitrary files (if the server has permissions to access the file).
These issues have been confirmed on TFTP Server 2000 Evaluation Version 1.0.0.1. Other versions may be affected as well.
FutureSoft TFTP Server 2000 is affected by multiple remote vulnerabilities. Exploiting these issues can allow an attacker to retrieve arbitrary files and carry out buffer-overflow attacks.
The following specific issues were identified:
- Multiple buffer overflow vulnerabilities. A successful attack may allow the attacker to execute arbitrary code on a vulnerable computer and gain unauthorized access in the context of the server. A denial-of-service condition may arise as well.
- A directory-traversal vulnerability. A successful attack may allow the attacker to access arbitrary files (if the server has permissions to access the file).
These issues have been confirmed on TFTP Server 2000 Evaluation Version 1.0.0.1. Other versions may be affected as well.
Exploit / POC
FutureSoft TFTP Server 2000 Multiple Remote Vulnerabilities
The following proof-of-concept examples are available:
A crafted packet with an overly long filename string.
------------------------------------------
|RRQ|AAAAAAAAAAAAAAAA....|NULL|octet|NULL|
------------------------------------------
A crafted packet with an overly long transfer-mode string.
------------------------------------------
|RRQ|a.txt|NULL|AAAAAAAAAAAAAAA.....|NULL|
------------------------------------------
tftp -i 192.168.2.5 GET ../../../../../boot.ini
A Metasploit proof-of-concept exploit is available from [email protected]:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
The following proof-of-concept examples are available:
A crafted packet with an overly long filename string.
------------------------------------------
|RRQ|AAAAAAAAAAAAAAAA....|NULL|octet|NULL|
------------------------------------------
A crafted packet with an overly long transfer-mode string.
------------------------------------------
|RRQ|a.txt|NULL|AAAAAAAAAAAAAAA.....|NULL|
------------------------------------------
tftp -i 192.168.2.5 GET ../../../../../boot.ini
A Metasploit proof-of-concept exploit is available from [email protected]:
Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
FutureSoft TFTP Server 2000 Multiple Remote Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
FutureSoft TFTP Server 2000 Multiple Remote Vulnerabilities
References:
References:
- FutureSoft TFTP Server 2000 Buffer Overflow and Directory Traversal (SIG^2 Vulnerability Research)
- TFTP Server 2000 Product Page (FutureSoft)