Multithreaded TFTP Server Remote Denial Of Service Vulnerability

Bugtraq ID:	19925
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 08 2006 12:00AM
Updated:	Sep 11 2006 06:48PM
Credit:	Discovery of this issue is credited to n00b.
Vulnerable:	Multithreaded TFTP Server 1.1
Not Vulnerable:

Multithreaded TFTP Server Remote Denial Of Service Vulnerability

Multithreaded TFTP Server is prone to a remote denial-of-service vulnerability because the application fails to handle a excessively long FTP command.

A remote attacker may exploit this issue to crash the affected service, denying further service to legitimate users.

Multithreaded TFTP Server Remote Denial Of Service Vulnerability

The following example exploit code is available:

• /data/vulnerabilities/exploits/multithreaded.tftpserver-1.1-dos.py

Multithreaded TFTP Server Remote Denial Of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

Multithreaded TFTP Server Remote Denial Of Service Vulnerability

References:

• Multithreaded TFTP Web Site (Multithreaded TFTP)