HP Ignite-UX TFTP Service Remote File Manipulation

2005-08-15T00:00:00
ID OSVDB:18750
Type osvdb
Reporter Martin O'Neal(martin.oneal@corsaire.com)
Modified 2005-08-15T00:00:00

Description

Vulnerability Description

Ignite-UX contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a malicious user accesses the TFTP Server anonymously. An error in handling the "add_new_client" command can cause sections of the TFTP server tree to become world writable, which could disclose any of the system files, resulting in a loss of confidentiality.

Solution Description

Upgrade to version C.6.2.241 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): Disable the TFTP server completely, if it doesn't interfere with your usage of the product.

Short Description

Ignite-UX contains a flaw that may lead to an unauthorized information disclosure. The issue is triggered when a malicious user accesses the TFTP Server anonymously. An error in handling the "add_new_client" command can cause sections of the TFTP server tree to become world writable, which could disclose any of the system files, resulting in a loss of confidentiality.

References:

Vendor Specific Advisory URL Security Tracker: 1014711 Secunia Advisory ID:16456 Related OSVDB ID: 18749 Mail List Post: http://archives.neohapsis.com/archives/vulnwatch/2005-q3/0027.html Keyword: SSRT4874 Keyword: c041123-002 Keyword: NISCC 688910 CVE-2004-0952