## TFTP Vulnerability

### Risk Factor: 8

### Machines Affected:

Ultrix 3.0 and older, and most UNIXes running unpatched tftpd.

### Description:

The TFTP protocol and daemon do no authentication checks by default, since it is usually only used to boot diskless workstations. This, in conjunction with the fact that it does not limit access to certain files, allows remote users to retrieve files or overwrite files remotely with no authentication process. If a remote user invokes tftp with either the r, g, or ag flags then a remote files can be copied and written locally.
Ex.

    tftp -(flag) access.txt victim.com /etc/passwd

This will write the remote file /etc/passwd as the local file access.txt. With the flags w, p, or ap a remote user can write to a remote file from a local file (an altered passwd file, for example). NOTE: normally tftp will not overwrite a file on the remote sytem. However, if the o flag is used, it will.

(another example)

    ~home% tftp
     tftp> connect victim.com
     tftp> get /etc/passwd /tmp/passwd.victim
     tftp> quit

### Consequences:

Critical system files can be stolen or overwritten, possibly giving a remote user full acces to the system.

### Fix:

- Restrict tftp access to limited parts of the file system.
- Disable tftp completely in inetd.conf.
- Use tftp in conjunction with Kerberos or some other authentication system.
- Configure tftp like so;

      	1.  Create an appropriate /etc/tftpaccess.ctl file.

              2.  From the directory containing the new tftpd module, issue
                  the following commands as root.

                  # chmod 644 /etc/tftpaccess.ctl
                  # chown root.system /etc/tftpaccess.ctl
                  # mv /etc/tftpd /etc/tftpd.old
                  # cp tftpd /etc
                  # chmod 755 /etc/tftpd
                  # chown root.system /etc/tftpd
                  # refresh -s inetd

  Links for advisories/more info
  Admin Guide to Cracking
  CERT Adv. CA-89:05
  CERT Adv. CA-91:18
  CERT Adv. CA-91:19