####################################################################### Luigi Auriemma Application: Timbuktu Pro Remote Control Software http://www.netopia.com/software/products/tb2/ Versions: <= 8.6.5 [RC 229] Platforms: Windows Mac OS X has not been tested Bugs: A] Denial of Service B] limited upload directory traversal Exploitation: remote Date: 10 Mar 2008 Author: Luigi Auriemma e-mail: aluigi (at) autistici (dot) org [email concealed] web: aluigi.org ####################################################################### 1) Introduction 2) Bugs 3) The Code 4) Fix ####################################################################### =============== 1) Introduction =============== Timbuktu is a software for controlling the computer remotely. ####################################################################### ======= 2) Bugs ======= -------------------- A] Denial of Service -------------------- The instructions which handle the incoming instant messages are vulnerable to a couple of Denial of Service attacks. The first one consists in the possibility of crashing the program through an invalid Version field while the other type of bug is the freezing and the subsequent termination of Timbuktu using an invalid or incomplete message. ------------------------------------- B] limited upload directory traversal ------------------------------------- Each message or attachment is considered by Timbuktu as a file which is stored in temporary folders in the program's directory. Although the program uses various ways to avoid possible directory traversal attacks is still possible for an attacker to upload files with any filename in any location of the disk on which Timbuktu is running. The only limitation in this vulnerability is that Timbuktu changes the name of the file if one with the same name already exists so for example if we specify notepad.exe but it already exists, the program will create the file notepad2.exe. Currently I have found no ways to bypass this limitation. ####################################################################### =========== 3) The Code =========== http://aluigi.org/poc/timbuto.zip ####################################################################### ====== 4) Fix ====== No fix ####################################################################### --- Luigi Auriemma http://aluigi.org