2X ThinClientServer TFTP service Directory Traversal Vulnerability

Bugtraq ID:	28504
Class:	Input Validation Error
CVE:	CVE-2008-1620
Remote:	Yes
Local:	No
Published:	Mar 29 2008 12:00AM
Updated:	May 07 2015 05:31PM
Credit:	Luigi Auriemma
Vulnerable:	2X ThinClientServer 5.0 sp1-r3497
Not Vulnerable:

2X ThinClientServer TFTP service Directory Traversal Vulnerability

2X ThinClientServer is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue allows an attacker to access arbitrary files outside of the TFTP application's root directory. This can expose sensitive information that could help the attacker launch further attacks.

2X ThinClientServer 5.0 sp1-r3497 with TFTPd.exe 3.2.0.0 is vulnerable; other versions may also be affected.

2X ThinClientServer TFTP service Directory Traversal Vulnerability

Attackers can use standard tools to exploit this issue.

The following proofs of concept are available:

tftpx SERVER .../.../.../.../.../.../boot.ini none
tftpx SERVER ...\...\...\...\...\...\windows\win.ini none

2X ThinClientServer TFTP service Directory Traversal Vulnerability

References:

• 2X ThinClientServer (Luigi Auriemma)
  
• ThinClientServer Homepage (2X)
  
• Directory traversal in 2X ThinClientServer v5.0_sp1-r3497 (Luigi Auriemma )