PT-2009-2954 · Tftputil · Tftputil Gui

CVE-2009-0288 · Publicado 2009-01-27 · Atualizado 2024-02-14

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TFTPUtil GUI versions 1.2.0 through 1.3.0

Description A directory traversal issue allows remote attackers to read arbitrary files outside the TFTP root directory via directory traversal sequences in a GET request, such as "/../" or "/../../". This could potentially expose sensitive information.

Recommendations For versions 1.2.0 and 1.3.0, consider restricting access to the TFTP server until a fix is available. As a temporary workaround, restrict the use of GET requests that contain directory traversal sequences. Avoid using the TFTPUtil GUI for sensitive operations until the issue is resolved.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2009-0288

Produtos afetados

Tftputil Gui

Referências · 7

• http://secunia.com/advisories/33561 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0288 · Nota de Segurança
• http://securityfocus.com/bid/33287 · Correção
• http://princeofnigeria.org/blogs/index.php/2009/01/14/tftputil-gui-tftp-directory-traversal · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48019 · Nota
• http://securityfocus.com/archive/1/500106/100/0/threaded · Nota
• http://sourceforge.net/forum/forum.php?forum_id=894598 · Correção