PT-2005-2779 · Futuresoft · Futuresoft Tftp Server

Published 2005-06-01 · Updated 2008-09-05 · CVE-2005-1812

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FutureSoft TFTP Server version 1.0.0.1

Description The issue allows remote attackers to execute arbitrary code via a long filename or transfer mode string in a Read Request (RRQ) or Write Request (WRQ) packet, due to multiple stack-based buffer overflows.

Recommendations For version 1.0.0.1, consider restricting the length of filenames and transfer mode strings in RRQ and WRQ packets to prevent buffer overflows until a patch is available. As a temporary workaround, limit access to the TFTP server to trusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2005-1812

Affected Products

Futuresoft Tftp Server

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/tftp/futuresoft_transfermode.rb · Exploit
• 🔥 https://exploit-db.com/exploits/1027 · Exploit
• 🔥 https://exploit-db.com/exploits/16344 · Exploit
• 🔥 http://securityfocus.com/bid/13821 · Exploit
• 🔥 http://security.org.sg/vuln/tftp2000-1001.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2005-1812 · Security Note
• http://secunia.com/advisories/15539 · Note
• http://securitytracker.com/id?1014079 · Note