CVE-2007-0888 Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) seq...
HighCVSS 10.0
EPSS 5.2%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in the TFTP server in Kiwi CatTools before 3.2.0 beta allows remote attackers to read arbitrary files, and upload files to arbitrary locations, via ..// (dot dot) sequences in the pathname argument to an FTP (1) GET or (2) PUT command.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kiwi enterprises kiwi cattools | All versions | No fix listed |
References
- 24103 third-party-advisory
- 2236 third-party-advisory
- www.kiwisyslog.com
- 33162 vdb-entry
- 20070208 TFTP directory traversal in Kiwi CatTools mailing-list
- 20070213 Re: TFTP directory traversal in Kiwi CatTools mailing-list
- 22490 vdb-entry
- ADV-2007-0536 vdb-entry
- kiwicattools-tftp-directory-traversal(32398) vdb-entry