FutureSoft TFTP Server 2000 Remote Denial Of Service Vulnerability

Bugtraq ID:	13908
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jun 09 2005 12:00AM
Updated:	Jun 09 2005 12:00AM
Credit:	Discovery of this issue is credited to Josh Zlatin-Amishav <[email protected]>.
Vulnerable:	FutureSoft TFTP Server 2000 1.0 .0.1
Not Vulnerable:

FutureSoft TFTP Server 2000 Remote Denial Of Service Vulnerability

FutureSoft TFTP Server 2000 is prone to a remote denial of service vulnerability. Reports indicate the issue manifests when the TFTP server handles certain types of UDP datagrams.

A remote attacker may exploit this issue to crash the affected service.

FutureSoft TFTP Server 2000 Remote Denial Of Service Vulnerability

An exploit is not required. The following example is available:

hping -2 xxx.xxx.xxx.xxx -p 69

FutureSoft TFTP Server 2000 Remote Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

FutureSoft TFTP Server 2000 Remote Denial Of Service Vulnerability

References:

• TFTP Server 2000 Product Page (FutureSoft)
  
• tftp 2000 1.0.0.1 (Josh Zlatin-Amishav )