Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » iDEFENSE Security Advisory 10.24.02: Directory Traversal in SolarWinds TFTP Serv

iDEFENSE Security Advisory 10.24.02: Directory Traversal in SolarWinds TFTP Serv

by Nikola Strahija on October 25th, 2002 The SolarWinds TFTP Server has the ability to send and receive multiple files concurrently. This TFTP Server is commonly used to upload/download executable images and configurations to routers, switches, hubs, XTerminals, etc. The software is freely available from http://support.solarwinds.net/updates/New-customerFree.cfm and also included in the Standard, Professional, and Professional PLus Editions of SolarWinds Network Management Tools.


II. DESCRIPTION

SolarWinds.net's TFTP Server is susceptible to a folder traversal
attack allowing attackers to retrieve any file from the application.
This vulnerability is often found due to a common programming error
in the handling of file paths. The process is best explained with an
example:

tftp target.server GET a....winntrepairsam

The above example will retrieve the Windows NT SAM file from the
target server as the file request is translated to:

C:TFTP-ROOTa....winntrepairsam

Where TFTP-ROOT is the default installed root directory.

III. ANALYSIS

Successful exploitation of this vulnerability provides attackers with
access to any file on the target system. It is possible for this
attack to lead to further compromise if for example the Windows NT
SAM file was retrieved. SolarWinds TFTP Server is a free,
multi-threaded TFTP server with security. More information about this
application can be found at
http://www.solarwinds.net/Tools/Free_tools/TFTP_Server/.

IV. DETECTION

iDEFENSE has verified the existence of this vulnerability in the
latest version of SolarWinds TFTP Server (v5.0.55). It is suspected
that earlier versions are vulnerable as well. A specific
implementation's susceptibility can be determined by experimenting
with the above-described specifics.

V. WORKAROUND

It is suggested that file transmittals be disabled if they are not
required. This can be accomplished by selecting the "Receive only"
radio button under the "FileConfigureSecurity" tab of the
application. A firewall that restricts access to the application to
only trusted sources could also help mitigate the attack.

Additionally, version 5.0.60 or later of the SolarWinds TFTP Server
does not have this vulnerability.

VI. VENDOR FIX/RESPONSE

This problem has been resolved in all versions of the SolarWinds TFTP
Server that are version 5.0.60 or later. Updated versions of all
SolarWinds Tools are now available from http://www.solarwinds.net

VII. CVE INFORMATION

The Mitre Corp.'s Common Vulnerabilities and Exposures (CVE) Project
has assigned the identification number CAN-2002-1209 to
this issue.

VIII. DISCLOSURE TIMELINE

09/22/2002 Issue disclosed to iDEFENSE
10/14/2002 Solarwinds.net notified
10/14/2002 iDEFENSE clients notified
10/14/2002 Response received from Josh Stevens ([email protected])
10/14/2002 Vendor fix made available
10/24/2002 Coordinated public disclosure

IX. CREDIT

Matthew Murphy ([email protected]) is credited with discovering
this vulnerability.


Get paid for security research
http://www.idefense.com/contributor.html


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »