|
 |
|
2X ThinClientServer 2XTFTPd Service Directory Traversal
|
|
|
|
|
Secunia Advisory:
|
SA29590
|
|
|
Release Date:
|
2008-03-31
|
|
Last Update:
|
2008-04-11
|
|
|
Critical:
|
Less critical
|
|
Impact:
|
Exposure of system information
Exposure of sensitive information
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Workaround
|
|
| Software: | 2X ThinClientServer 5.x
|
| | CVE reference: | CVE-2008-1620 (Secunia mirror)
|
|
|
|
|
|
Description:
Luigi Auriemma has discovered a vulnerability in 2X ThinClientServer, which can be exploited by malicious people to disclose potentially sensitive information.
The vulnerability is caused due an input validation error within the 2XTFTPd service (TFTPd.exe) and can be exploited to download files from arbitrary locations outside the TFTP root via specially crafted directory traversal sequences.
The vulnerability is confirmed in 2X ThinClientServer version 5.0 (sp1-r3497) including TFTPd.exe version 3.2.0.0. Other versions may also be affected.
Solution:
Fixed in version 5.0 SP1-r3606.
http://downloads.2x.com/thinclientser...nClientServer-5_0-sp1-r3606-setup.exe
Restrict network access to the TFTP service.
Provided and/or discovered by:
Luigi Auriemma
Changelog:
2008-04-03: Updated "Solution" section.
2008-04-11: Added CVE reference.
Original Advisory:
2X:
http://www.2x.com/forums/viewtopic.php?t=2120
http://aluigi.altervista.org/adv/thindirtrav-adv.txt
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
