Philippe Jounin Tftpd32 Long Filename Denial Of Service Vulnerability

Bugtraq ID:	37119
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-4882
Remote:	Yes
Local:	No
Published:	Jan 12 2005 12:00AM
Updated:	Nov 24 2009 10:25PM
Credit:	Sowhat
Vulnerable:	Philippe Jounin TFTPD32 2.74
Not Vulnerable:	Philippe Jounin TFTPD32 2.80

Philippe Jounin Tftpd32 Long Filename Denial Of Service Vulnerability

Philippe Jounin Tftpd32 is prone to a denial-of-service vulnerability.

A successful exploit may allow attackers to crash the server process, resulting in a denial-of-service condition.

Tftpd32 2.74 is vulnerable; other versions may also be affected.

NOTE: Wyse Simple Imager includes the vulnerable application; other products may also include it.

Philippe Jounin Tftpd32 Long Filename Denial Of Service Vulnerability

An attacker can exploit this issue by using readily available command-line utilities.

Philippe Jounin Tftpd32 Long Filename Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for details.


Philippe Jounin TFTPD32 2.74

• Philippe Jounin tftpd32.280.zip
  http://tftpd32.jounin.net/download/tftpd32.280.zip

Philippe Jounin Tftpd32 Long Filename Denial Of Service Vulnerability

References:

• TFTPD32 Homepage (Philippe Jounin)
  
• Wyse Simple Imager (WSI) includes vulnerable versions of TFTPD32 (US-CERT)