Test ID:	1.3.6.1.4.1.25623.1.0.80016
Category:	Remote file access
Title:	Kiwi CatTools < 3.2.9 Directory Traversal
Summary:	The remote host appears to be running Kiwi CatTools, a freeware; application for device configuration management and is affected by a directory traversal vulnerability.
Description:	Summary: The remote host appears to be running Kiwi CatTools, a freeware application for device configuration management and is affected by a directory traversal vulnerability. Vulnerability Insight: The TFTP server included with the version of Kiwi CatTools installed on the remote host fails to sanitize filenames of directory traversal sequences. Vulnerability Impact: An attacker can exploit this issue to get or put arbitrary files on the affected host subject to the privileges of the user id under which the server operates, LOCAL SYSTEM by default. Solution: Upgrade to Kiwi CatTools version 3.2.9 or later. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-0888 BugTraq ID: 22490 http://www.securityfocus.com/bid/22490 Bugtraq: 20070208 TFTP directory traversal in Kiwi CatTools (Google Search) http://www.securityfocus.com/archive/1/459500/100/0/threaded Bugtraq: 20070213 Re: TFTP directory traversal in Kiwi CatTools (Google Search) http://www.securityfocus.com/archive/1/459933/100/0/threaded http://www.osvdb.org/33162 http://secunia.com/advisories/24103 http://securityreason.com/securityalert/2236 http://www.vupen.com/english/advisories/2007/0536 XForce ISS Database: kiwicattools-tftp-directory-traversal(32398) https://exchange.xforce.ibmcloud.com/vulnerabilities/32398
Copyright	Copyright (C) 2008 Ferdy Riphagen

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.