PT-2009-2954 · Tftputil · Tftputil Gui

Published 2009-01-27 · Updated 2024-02-14 · CVE-2009-0288

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions TFTPUtil GUI versions 1.2.0 through 1.3.0

Description A directory traversal issue allows remote attackers to read arbitrary files outside the TFTP root directory via directory traversal sequences in a GET request, such as "/../" or "/../../". This could potentially expose sensitive information.

Recommendations For versions 1.2.0 and 1.3.0, consider restricting access to the TFTP server until a fix is available. As a temporary workaround, restrict the use of GET requests that contain directory traversal sequences. Avoid using the TFTPUtil GUI for sensitive operations until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2009-0288

Affected Products

Tftputil Gui

References · 7

• http://secunia.com/advisories/33561 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0288 · Security Note
• http://securityfocus.com/bid/33287 · Patch
• http://sourceforge.net/forum/forum.php?forum_id=894598 · Patch
• http://princeofnigeria.org/blogs/index.php/2009/01/14/tftputil-gui-tftp-directory-traversal · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48019 · Note
• http://securityfocus.com/archive/1/500106/100/0/threaded · Note