A vulnerability has been identified in TFTPD32, which could be exploited by attackers to cause a denial of service. This flaw is due to an error when processing overly long arguments passed to a "GET" or "PUT" command, which could be exploited by malicious users to crash a vulnerable application, creating a denial of service condition.

Affected Products

TFTPD32 version 3.02 and prior

Solution

Upgrade to TFTPD32 version 3.03 :
http://tftpd32.jounin.net/tftpd32_download.html

References

http://www.vupen.com/english/advisories/2006/4606

Credits

Vulnerability reported by liuqx

Changelog

2006-11-20 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.