Tftpd32 SEND / GET Remote Format String Vulnerability
BID:16333
Info
Tftpd32 SEND / GET Remote Format String Vulnerability
| Bugtraq ID: | 16333 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 19 2006 12:00AM |
| Updated: | Feb 07 2006 08:54PM |
| Credit: | Discovery is credited to Critical Security Team. |
| Vulnerable: |
Philippe Jounin TFTPD32 2.81 |
| Not Vulnerable: | |
Discussion
Tftpd32 SEND / GET Remote Format String Vulnerability
A remote format-string vulnerability affects Tftpd32.
This issue presents itself when the TFTP server attempts to process specially crafted data through the SEND or GET commands.
A remote attacker may leverage this issue to execute arbitrary code in the context of the server.
Tftpd32 2.81 is reportedly vulnerable. Other versions may be affected as well.
A remote format-string vulnerability affects Tftpd32.
This issue presents itself when the TFTP server attempts to process specially crafted data through the SEND or GET commands.
A remote attacker may leverage this issue to execute arbitrary code in the context of the server.
Tftpd32 2.81 is reportedly vulnerable. Other versions may be affected as well.
Exploit / POC
Tftpd32 SEND / GET Remote Format String Vulnerability
A denial of service proof-of-concept exploit was released.
A denial of service proof-of-concept exploit was released.
Solution / Fix
Tftpd32 SEND / GET Remote Format String Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]
References
Tftpd32 SEND / GET Remote Format String Vulnerability
References:
References: