Executive brief
A vulnerability in early Linux implementations of the Trivial File Transfer Protocol (TFTP) service allows unauthorized users to access files outside of the intended restricted directory. This could lead to the exposure of sensitive system files or the modification of data by remote attackers. Because TFTP often lacks robust authentication, this flaw poses a significant risk to the confidentiality and integrity of the affected server.
Technical details
The vulnerability is a path traversal or directory escape flaw within the Linux TFTP daemon. Due to improper validation of file paths in incoming requests, a remote, unauthenticated attacker can use specially crafted filenames (such as those containing '../' sequences) to read or write files outside the designated TFTP root directory. This occurs because the implementation fails to properly 'chroot' or otherwise restrict the file system scope to the intended directory. Attackers can exploit this over the network via UDP port 69 to retrieve sensitive configuration files or overwrite system data.
Affected products
- Linux Linux TFTP implementation
Timeline
- 1997-09-01: disclosed