Description
Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
3CTftpSvc TFTP Long Mode Buffer Overflow
exploit/windows/tftp/threectftpsvc_long_mode
Exploit-DB 5
- 3Com TFTP Service (3CTftpSvc) - 'Mode' Remote Buffer Overflow (Metasploit) EDB-16347 · remote · May 9, 2010 · verified
- 3Com TFTP Service (3CTftpSvc) 2.0.1 - Long Transporting Mode EDB-3388 · remote · Feb 28, 2007 · verified
- 3Com TFTP Service (3CTftpSvc) 2.0.1 - Remote Buffer Overflow (Metasploit) EDB-3170 · remote · Jan 21, 2007 · verified
- 3Com TFTP Service (3CTftpSvc) 2.0.1 - 'Long Transporting Mode' Remote Overflow EDB-2865 · remote · Nov 30, 2006 · verified
- 3Com TFTP Service (3CTftpSvc) 2.0.1 - 'Long Transporting Mode' Overflow (PoC) EDB-2855 · dos · Nov 27, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2006-4738 vdb-entry
- 21301 vdb-entry
- 3ctftpsvc-transporting-mode-bo(30545) vdb-entry
- 21322 vdb-entry
- 1930 third-party-advisory
- 23113 third-party-advisory
- 20061126 TFTP Server 3CTftpSvc Buffer Overflow Vulnerability (Long transporting mode) mailing-list