Secunia

Some vulnerabilities have been reported in TFTP Server 2000, which can be exploited by malicious people to cause a DoS (Denial of Service), gain knowledge of sensitive information or compromise a vulnerable system.

1) Boundary errors within the handling of Read and Write requests can be exploited to cause a stack-based buffer overflow via a request containing an overly long filename or transfer-mode string.

Successful exploitation allows execution of arbitrary code with SYSTEM privileges.

2) Missing input validation can be exploited to access arbitrary files outside the TFTP root via directory traversal attacks.

3) An error in the handling of UDP datagrams can be exploited to crash a vulnerable service by sending some specially crafted UDP datagrams.

The vulnerabilities have been reported in version 1.0.0.1. Other versions may also be affected.

Solution
Use the product on isolated subnets with trusted users only.

Provided and/or discovered by
1-2) Tan Chew Keong
3) Josh Zlatin-Amishav

Changelog
Further details available in Customer Area

Original Advisory
http://www.security.org.sg/vuln/tftp2000-1001.html

Deep Links
Links available in Customer Area