Vulnerabilities in Timbuktu Pro 8.6.5

[Luigi Auriemma <aluigi () autistici org>]

#######################################################################

                             Luigi Auriemma

Application:  Timbuktu Pro Remote Control Software
              http://www.netopia.com/software/products/tb2/
Versions:     <= 8.6.5 [RC 229]
Platforms:    Windows
              Mac OS X has not been tested
Bugs:         A] Denial of Service
              B] limited upload directory traversal
Exploitation: remote
Date:         10 Mar 2008
Author:       Luigi Auriemma
              e-mail: aluigi () autistici org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Timbuktu is a software for controlling the computer remotely.


#######################################################################

=======
2) Bugs
=======

--------------------
A] Denial of Service
--------------------

The instructions which handle the incoming instant messages are
vulnerable to a couple of Denial of Service attacks.
The first one consists in the possibility of crashing the program
through an invalid Version field while the other type of bug is the
freezing and the subsequent termination of Timbuktu using an invalid or
incomplete message.


-------------------------------------
B] limited upload directory traversal
-------------------------------------

Each message or attachment is considered by Timbuktu as a file which is
stored in temporary folders in the program's directory.
Although the program uses various ways to avoid possible directory
traversal attacks is still possible for an attacker to upload files
with any filename in any location of the disk on which Timbuktu is
running.

The only limitation in this vulnerability is that Timbuktu changes the
name of the file if one with the same name already exists so for
example if we specify notepad.exe but it already exists, the program
will create the file notepad2.exe.
Currently I have found no ways to bypass this limitation.


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/timbuto.zip


#######################################################################

======
4) Fix
======


No fix


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org