NetDecision TFTP Server 4.2 TFTP Directory Traversal

2009-05-21T00:00:00
ID SECURITYVULNS:DOC:21860
Type securityvulns
Reporter Securityvulns
Modified 2009-05-21T00:00:00

Description

[--Vulnerability Summary--]

Title: NetDecision TFTP Server 4.2 TFTP Directory Traversal Product: NetDecision TFTP Server 4.2

Discovered: April 1, 2009 Discovered by: Rob Kraus, princeofnigeria (PoN)

Vendor: NetMechanica Vendor URL: http://www.netmechanica.com/downloads/ Vendor notification date: April 2, 2009 and May 12, 2009 Vendor response date: None Vendor acknowledgement: No Vendor provided fix: No Release coordinated with the vendor: No response from vendor Public disclosure date: May 16, 2009

Affects: NetDecision TFTP Server 4.2 Fixed in: N/A Risk: MEDIUM

Vulnerability Description: NetDecision TFTP Server 4.2 is prone to a directory-traversal vulnerability because it fails to sanitize TFTP GET and PUT requests. By using a specially crafted TFTP request an attacker is capable of putting (PUT) and retrieving (GET) files outside of the TFTP root directory.

Impact: The ability to PUT and GET files outside of the TFTP root directory may allow an attacker to obtain more information about the underlying operating system and applications running on the host. Additionally, malicious code can be uploaded to the host operating system.

[--Background--]

Type of vulnerability: Input validation flaw Who can exploit it: Local and remote users

Vulnerability Scope: The default installation of NetDecision TFTP Server 4.2 will allow exploitation of this vulnerability.

Keywords: security, vulnerability, tftp, directory traversal, princeofnigeria, gui, windows, server

[--Background--]

Type of vulnerability: Input validation flaw Who can exploit it: Local and remote users

NetDecision TFTP Server 4.2 is an application that provides services for transferring configuration files, firmware files and other types of data using the TFTP protocol. The application should restrict PUT and GET requests to the contents of the TFTP root directory to prevent obtaining data from other parts of the host operating system or uploading malicious code.

Vulnerability Scope: The default installation of NetDecision TFTP Server 4.2 will allow exploitation of this vulnerability.

[--More Details--]

Exploitation of this flaw is trivial and can be executed using any RFC 1350 compliant TFTP client software. No exploit code is required.

[--Fix or Workaround Information--]

Patch availability: None Vendor provided fix: None Workarounds: None available at this time, design flaw. Discontinue use of this product until a stable patch is released.

[--Disclosure Policy--]

PrinceofNigeria.org Vulnerability Disclosure Policy http://www.princeofnigeria.org/blogs/index.php/vulndev/vulnreleasepolicy/?blog=1

[--Disclosure History--] Public disclosure date: May 16, 2009

[--References--] CVE-ID: Bugtraq ID: Secunia ID: OSVDB ID:

[--Author--] Rob Kraus, princeofnigeria (PoN) Website: www.princeofnigeria.org/blogs