PT-2002-3065 · Philserv · Tftpd32

Published 2002-12-31 · Updated 2009-11-24 · CVE-2002-2353

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions tftpd32 versions 2.50 through 2.50.2

Description The issue allows remote attackers to read or write arbitrary files via a full pathname in GET and PUT requests, such as "/api/v1/download" or "/files/{filename}". Vulnerable parameters include filename and filepath.

Recommendations For versions 2.50 and 2.50.2, consider restricting access to the tftpd32 service until a patch is available. As a temporary workaround, avoid using full pathnames in GET and PUT requests. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2002-2353

Affected Products

Tftpd32

References · 7

• 🔥 http://securiteam.com/windowsntfocus/6D00D2061G.html · Exploit
• 🔥 https://exploit-db.com/exploits/22024 · Exploit
• 🔥 http://securityfocus.com/bid/6198 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2002-2353 · Security Note
• http://tftpd32.jounin.net · Note
• http://iss.net/security_center/static/10646.php · Note
• http://kb.cert.org/vuls/id/632633 · Note