PT-2009-1151 · Philserv · Tftpd32

Publicado 2009-11-20 · Atualizado 2009-11-23 · CVE-2005-4882

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Tftpd32 versions 2.74 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending a TFTP read request with a long filename. This can be achieved through a TFTP read (aka RRQ or get) request.

Recommendations For Tftpd32 versions 2.74 and earlier, consider restricting the length of filenames in TFTP read requests to prevent the daemon from crashing until a fix is available.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2005-4882

Produtos afetados

Tftpd32

Referências · 6

• 🔥 http://securitytracker.com/id?1012856 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2005-01/0386.html · Exploit
• 🔥 http://secway.org/advisory/ad20050108.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-4882 · Nota de Segurança
• http://osvdb.org/12898 · Nota
• http://kb.cert.org/vuls/id/632633 · Nota