TFTPD32 Input Validation Flaw Lets Remote Users Read and Write Files on the System
Categorie: Vulnerability Posted: 2002-11-20 by ReCall Views: 359 Source: Click here
Current Rating: Not rated
Details
Description: An input validation vulnerability was reported in TFTPD32. A remote user can view and write to files on the server located outside of the document directory.
SecuriTeam reported that a remote user can read and write any file on the system. Some demonstration exploit commands are provided:
tftp host GET /boot.ini
tftp host PUT myfile /boot.ini
Impact: A remote user can view files and write to files on the system that are located outside of the document directory.
Solution: The vendor has issued a fixed version (2.51), available at:
