Vulnerability   
Search   
    Search 202850 CVE descriptions
and 87302 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.80016
Category:Remote file access
Title:Kiwi CatTools < 3.2.9 Directory Traversal
Summary:The remote host appears to be running Kiwi CatTools, a freeware; application for device configuration management and is affected by a directory traversal vulnerability.
Description:Summary:
The remote host appears to be running Kiwi CatTools, a freeware
application for device configuration management and is affected by a directory traversal vulnerability.

Vulnerability Insight:
The TFTP server included with the version of Kiwi CatTools installed
on the remote host fails to sanitize filenames of directory traversal sequences.

Vulnerability Impact:
An attacker can exploit this issue to get or put arbitrary
files on the affected host subject to the privileges of the user id
under which the server operates, LOCAL SYSTEM by default.

Solution:
Upgrade to Kiwi CatTools version 3.2.9 or later.

CVSS Score:
10.0

CVSS Vector:
AV:N/AC:L/Au:N/C:C/I:C/A:C

Cross-Ref: BugTraq ID: 22490
Common Vulnerability Exposure (CVE) ID: CVE-2007-0888
http://www.securityfocus.com/bid/22490
Bugtraq: 20070208 TFTP directory traversal in Kiwi CatTools (Google Search)
http://www.securityfocus.com/archive/1/459500/100/0/threaded
Bugtraq: 20070213 Re: TFTP directory traversal in Kiwi CatTools (Google Search)
http://www.securityfocus.com/archive/1/459933/100/0/threaded
http://www.osvdb.org/33162
http://secunia.com/advisories/24103
http://securityreason.com/securityalert/2236
http://www.vupen.com/english/advisories/2007/0536
XForce ISS Database: kiwicattools-tftp-directory-traversal(32398)
https://exchange.xforce.ibmcloud.com/vulnerabilities/32398
CopyrightCopyright (C) 2008 Ferdy Riphagen

This is only one of 87302 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2021 E-Soft Inc. All rights reserved.