PT-2013-6121 · Phjounin · Tftpd32

Fara Rustein · Published 2013-12-13 · Updated 2017-08-29 · CVE-2013-6809

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Tftpd32 versions prior to 4.50

Description The issue is related to a format string vulnerability in the client. This vulnerability can be exploited by remote servers, potentially leading to a denial of service (crash) or the execution of arbitrary code. The exploitation occurs through format string specifiers in the Remote File field.

Recommendations For versions prior to 4.50, update to version 4.50 or later to resolve the issue.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2013-6809

Affected Products

Tftpd32

References · 5

• 🔥 http://seclists.org/fulldisclosure/2013/Dec/15 · Exploit
• 🔥 http://packetstormsecurity.com/files/124275/Tftpd32-Client-Side-Format-String.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6809 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89455 · Note
• http://osvdb.org/100511 · Note