NetDecision TFTP Server 4.2 TFTP Directory Traversal

[vuln_research@xxxxxxxxxxxxxxxxxxx]

[--Vulnerability Summary--]

Title: NetDecision TFTP Server 4.2 TFTP Directory Traversal
Product: NetDecision TFTP Server 4.2

Discovered: April 1, 2009
Discovered by: Rob Kraus, princeofnigeria (PoN)

Vendor: NetMechanica
Vendor URL: http://www.netmechanica.com/downloads/
Vendor notification date: April 2, 2009 and May 12, 2009
Vendor response date: None
Vendor acknowledgement: No
Vendor provided fix: No
Release coordinated with the vendor: No response from vendor
Public disclosure date: May 16, 2009

Affects: NetDecision TFTP Server 4.2
Fixed in: N/A
Risk: MEDIUM

Vulnerability Description: NetDecision TFTP Server 4.2 is prone to a 
directory-traversal vulnerability because it fails to sanitize TFTP GET and PUT 
requests. By using a specially crafted TFTP request an attacker is capable of 
putting (PUT) and retrieving (GET) files outside of the TFTP root directory.

Impact: The ability to PUT and GET files outside of the TFTP root directory may 
allow an attacker to obtain more information about the underlying operating 
system and applications running on the host. Additionally, malicious code can 
be uploaded to the host operating system.

[--Background--]

Type of vulnerability: Input validation flaw
Who can exploit it: Local and remote users

Vulnerability Scope: The default installation of NetDecision TFTP Server 4.2 
will allow exploitation of this vulnerability.

Keywords: security, vulnerability, tftp, directory traversal, princeofnigeria, 
gui, windows, server

[--Background--]

Type of vulnerability: Input validation flaw
Who can exploit it: Local and remote users

NetDecision TFTP Server 4.2 is an application that provides services for 
transferring configuration files, firmware files and other types of data using 
the TFTP protocol. The application should restrict PUT and GET requests to the 
contents of the TFTP root directory to prevent obtaining data from other parts 
of the host operating system or uploading malicious code.

Vulnerability Scope: The default installation of NetDecision TFTP Server 4.2 
will allow exploitation of this vulnerability.

[--More Details--]

Exploitation of this flaw is trivial and can be executed using any RFC 1350 
compliant TFTP client software. No exploit code is required.

[--Fix or Workaround Information--]

Patch availability: None
Vendor provided fix: None
Workarounds: None available at this time, design flaw. Discontinue use of this 
product until a stable patch is released.

[--Disclosure Policy--]

PrinceofNigeria.org Vulnerability Disclosure Policy
http://www.princeofnigeria.org/blogs/index.php/vulndev/vulnreleasepolicy/?blog=1

[--Disclosure History--]
Public disclosure date: May 16, 2009

[--References--]
CVE-ID:
Bugtraq ID:
Secunia ID:
OSVDB ID:

[--Author--]
Rob Kraus, princeofnigeria (PoN)
Website: www.princeofnigeria.org/blogs