This host is running TFTPD32 and is prone to format string vulnerability.

Successful exploitation will allow attacker to cause a denial of service. Impact Level: Application

Upgrade to Tftpd32 version 2.8.2 or later, For updates refer to http://tftpd32.jounin.net/

The flaw is due to a format string error when the filename received in a TFTP request is used to construct an error message. This can be exploited to crash the application via a TFTP request packet containing a specially crafted filename.

Tftpd32 version 2.81

• http://secunia.com/advisories/18539
• http://www.exploit-db.com/exploits/1424
• http://www.kb.cert.org/vuls/id/632633
• http://www.osvdb.org/22661
• http://www.securityfocus.com/archive/1/422405
• http://xforce.iss.net/xforce/xfdb/24250

---

Updated on 2015-03-25