{"uuid": "02ad41df-7988-496e-bcdf-96d6c02fa5b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2008-1611", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/tftp/tftpserver_wrq_bof.rb", "content": "{\"aliases\": [], \"arch\": \"\", \"author\": [\"Mati Aharoni\", \"Datacut\"], \"autofilter_ports\": [], \"autofilter_services\": [], \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability found in TFTP Server 1.4 ST.  The flaw\\n          is due to the way TFTP handles the filename parameter extracted from a WRQ request.\\n          The server will append the user-supplied filename to TFTP server binary's path\\n          without any bounds checking, and then attempt to check this path with a fopen().\\n          Since this isn't a valid file path, fopen() returns null, which allows the\\n          corrupted data to be used in a strcmp() function, causing an access violation.\\n\\n          Since the offset is sensitive to how the TFTP server is launched, you must know\\n          in advance if your victim machine launched the TFTP as a 'Service' or 'Standalone'\\n          , and then manually select your target accordingly. A successful attempt will lead\\n          to remote code execution under the context of SYSTEM if run as a service, or\\n          the user if run as a standalone. A failed attempt will result a denial-of-service.\", \"disclosure_date\": \"2008-03-26\", \"fullname\": \"exploit/windows/tftp/tftpserver_wrq_bof\", \"is_install_path\": true, \"mod_time\": \"2025-06-23 12:43:46 +0000\", \"name\": \"TFTP Server for Windows 1.4 ST WRQ Buffer Overflow\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"unknown-reliability\"], \"SideEffects\": [\"unknown-side-effects\"], \"Stability\": [\"unknown-stability\"]}, \"path\": \"/modules/exploits/windows/tftp/tftpserver_wrq_bof.rb\", \"platform\": \"Windows\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"windows/tftp/tftpserver_wrq_bof\", \"references\": [\"CVE-2008-1611\", \"OSVDB-43785\", \"BID-18345\", \"EDB-5314\"], \"rport\": 69, \"session_types\": false, \"targets\": [\"Windows XP SP2/SP3 EN Service Mode\", \"Windows XP SP2/SP3 EN Standalone Mode\", \"Windows 7 SP0/SP1 EN x64 Service Mode\", \"Windows 7 SP0/SP1 EN x64 Standalone Mode\", \"Windows 7 SP0/SP1 EN x86 Service Mode\", \"Windows 7 SP0/SP1 EN x86 Standalone Mode\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:52:36.937783Z"}