NetDecision TFTP Server Directory Traversal Vulnerability
BID:35002
Info
NetDecision TFTP Server Directory Traversal Vulnerability
| Bugtraq ID: | 35002 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-1730 |
| Remote: | Yes |
| Local: | No |
| Published: | May 17 2009 12:00AM |
| Updated: | Aug 09 2012 09:42AM |
| Credit: | Rob Kraus |
| Vulnerable: |
NetMechanica NetDecision TFTP Server 4.2 |
| Not Vulnerable: | |
Discussion
NetDecision TFTP Server Directory Traversal Vulnerability
NetDecision TFTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue can allow an attacker to upload and download arbitrary files outside of the TFTP server root directory. This could help the attacker launch further attacks.
NetDecision TFTP Server 4.2 is vulnerable; other versions may also be affected.
NetDecision TFTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.
Exploiting this issue can allow an attacker to upload and download arbitrary files outside of the TFTP server root directory. This could help the attacker launch further attacks.
NetDecision TFTP Server 4.2 is vulnerable; other versions may also be affected.
Exploit / POC
NetDecision TFTP Server Directory Traversal Vulnerability
Attackers can use readily available tools to exploit this issue.
Attackers can use readily available tools to exploit this issue.
Solution / Fix
NetDecision TFTP Server Directory Traversal Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
NetDecision TFTP Server Directory Traversal Vulnerability
References:
References: