Kiwi CatTools TFTP 3.2.8 - Directory Traversal

Kiwi CatTools TFTP 3.2.8 - Directory Traversal Path traversal security vulnerability in Kiwi CatTools TFTP up to 3.2.8 server can lead to information disclosure and remote code execution Risk: High DISCUSSION Kiwi CatTools TFTP server doesn.t properly verify filename in PUT and GET request which...

Kiwi CatTools TFTP目录遍历漏洞

Kiwi CatTools是一个管理网络设备如路由器、交换机与防火墙的工具。 CatTools TFTP服务器处理请求时存在输入验证漏洞，远程攻击者可能利用此漏洞遍历服务器目录访问任意文件。 CatTools TFTP服务器没有正确检查请求文件路径中的目录遍历串，允许远程攻击者通过特制的目录遍历序列向TFTP根目录以外的任意位置上传或下载任意文件。 Kiwi CatTools 3.2.0 beta 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.kiwisyslog.com/cattools-info.php tftp -i 10.11.12.1...

cattools-traverse.txt

TFTP directory traversal in Kiwi CatTools Application : Kiwi CatTools prior to 3.2.0 beta Release Date : 8 February 2007 Author : Nicob Product : ========= http://www.kiwisyslog.com/cattools-info.php : "Kiwi CatTools is a freeware application that provides automated device configuration managemen...

Directory traversal

Kiwi CatTools before 3.2.0 beta uses weak encryption "reversible encoding" for passwords, account names, and IP addresses in kiwidb-cattools.kdb, which might allow local users to gain sensitive information by decrypting the file. NOTE: this issue could be leveraged with a directory traversal...

CVE-2007-0888

Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// dot dot sequences in the pathname argument to an FTP 1 GET or 2 PUT command...

CVE-2007-0889

Kiwi CatTools before 3.2.0 beta uses weak encryption "reversible encoding" for passwords, account names, and IP addresses in kiwidb-cattools.kdb, which might allow local users to gain sensitive information by decrypting the file. NOTE: this issue could be leveraged with a directory traversal...

Directory traversal

Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// dot dot sequences in the pathname argument to an FTP 1 GET or 2 PUT command...

CVE-2007-0889

Kiwi CatTools before 3.2.0 beta uses weak encryption "reversible encoding" for passwords, account names, and IP addresses in kiwidb-cattools.kdb, which might allow local users to gain sensitive information by decrypting the file. NOTE: this issue could be leveraged with a directory traversal...

CVE-2007-0889

Kiwi CatTools before version 3.2.0 beta stores passwords, account names, and IP addresses in kiwidb-cattools.kdb using reversible encoding, which may allow local users to decrypt sensitive data. The issue could be leveraged with a directory traversal vulnerability for a remote vector. Affected pr...

CVE-2007-0888

Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// dot dot sequences in the pathname argument to an FTP 1 GET or 2 PUT command...

CVE-2007-0888

Kiwi CatTools contains a directory traversal vulnerability in its TFTP server. The flaw allows remote attackers to read arbitrary files and upload files via ..// sequences in the pathname of GET/PUT requests. Public analyses reference Kiwi CatTools

TFTP directory traversal in Kiwi CatTools

TFTP directory traversal in Kiwi CatTools Application : Kiwi CatTools prior to 3.2.0 beta Release Date : 8 February 2007 Author : Nicob nicob at nicob.net Product : ========= http://www.kiwisyslog.com/cattools-info.php : "Kiwi CatTools is a freeware application that provides automated device...