Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against 3Com TFTP Server Buffer Overflow Vulnerability

Subscribe

Check Point Reference: CPAI-2007-014
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory: SA23113
Industry Reference(s): CVE-2006-6183
Protection Provided by: VPN-1
  • NGX R62
  • NGX R61
  • NGX R60
  • NG with Application Intelligence R55W
  • NG with Application Intelligence R55
VSX
  • NGX
InterSpect
  • NGX
  • 2.0 and 1.x
Connectra
  • NGX R62
  • NGX R61
Who is Vulnerable?
3Com TFTP Server 2.0.1 and prior
Vulnerability Description
A buffer overflow vulnerability has been discovered in 3Com TFTP server for Microsoft Windows. Trivial File Transfer Protocol (TFTP) is a protocol used for transferring files, allowing remote users to download and upload files to the server. 3Com TFTP Server is a TFTP server service used for easier transfer of files to or from the server. The vulnerability could be exploited by remote attackers to crash the service and execute arbitrary code.
Vulnerability Details
The vulnerability is due to a buffer overflow error in the 3Com TFTP server. The service fails to properly handle overly long TFTP Read or Write requests. An attacker can exploit this issue via a specially crafted TFTP request. Successful exploitation allows an attacker to create a denial of service condition or execute arbitrary code on an affected system.

Protection Overview
Malformed TFTP packets may cause a buffer overflow on an affected TFTP server. By enabling the protection, SmartDefense will block malformed TFTP requests.

In order for the protection to be activated, update your VPN-1/InterSpect/Connectra product to the latest SmartDefense update. For information on how to update SmartDefense, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Additional Information
The Update released on February 22, 2007 includes the following protections:

AOL (CDDB) Control Buffer Overflow Vulnerability (CPAI-2007-013)
3Com TFTP Server Buffer Overflow Vulnerability (CPAI-2007-014)
IBM Tivoli Storage Manager Buffer Overflow Vulnerability (CPAI-2007-015)
CA BrightStor Discovery Buffer Overflow Vulnerability (CPAI-2007-016)
Symantec Veritas NetBackup Buffer Overflow Vulnerability (CPAI-2007-017)
Novell NetMail NMAP Buffer Overflow Vulnerability (CPAI-2007-018)
Citrix Presentation Remote Code Execution Vulnerability (CPAI-2007-019)
Microsoft Windows SNMP Memory Corruption Vulnerability (MS06-074) - CPAI-2007-020
Novell Print Spooler Buffer Overflow Vulnerability (CPAI-2007-021)
Novell eDirectory Denial of Service Vulnerability (CPAI-2007-022)
Microsoft Windows Print Spooler Service Denial of Service Vulnerability (CPAI-2007-023)
Multiple SNMP Vulnerabilities (SBP-2007-03)

VPN-1 NGX R62

How Can I Protect My Network?
1. In the SmartDefense tab, click Application Intelligence > TFTP > Block Long File Names.



2. In the configuration pane, under Settings > Mode, check Active.



3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: TFTP Enforcement Violation
Attack Information: Long filename detected

VPN-1 NGX R61, R60 & VPN-1 NG with Application Intelligence R55W

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > TFTP.
2. Select the following:

Block Long File Names 



3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: TFTP Enforcement Violation
Attack Information: Long filename detected

VPN-1 NG with Application Intelligence R55

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > TFTP.
2. Select the following:

Block Long File Names

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #99069 will appear on the SmartView Tracker.

VPN-1 VSX NGX

How Can I Protect My Network?
1. In the SmartDefense tree, click Application Intelligence > TFTP.
2. Select the following:

Block Long File Names

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Rule #99069 will appear on the SmartView Tracker.

InterSpect NGX

How Can I Protect My Network?
1. In the lefthand menu, click Profiles > Default Protection > SmartDefense. The SmartDefense page opens.
2. In the SmartDefense tree, click Application Intelligence > TFTP and enable the following protection:

Block Long File Names

3. Install security policy.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: TFTP Enforcement Violation
Attack Information: Long filename detected

InterSpect 2.0

How Can I Protect My Network?
1. Click Application Intelligence > TFTP and enable the following protection:

Block Long File Names

2. Install security policy.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: TFTP Enforcement Violation
Attack Information: Long filename detected

Connectra NGX R62/R61

How Can I Protect My Network?
1. In the navigation tree, click Security > SmartDefense > Application Intelligence.
2. In the Dynamic Attacks pane enable the following pattern:

Block Long File Names

3. Install policy on all modules.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Attack Name: TFTP Enforcement Violation
Attack Information: Long filename detected