YaTFTPSvr TFTP Server is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input. A remote attacker could exploit this vulnerability using directory- traversal strings (such as '../') to upload and download arbitrary files outside of the TFTP server root directory. This could help the attacker launch further attacks. YaTFTPSvr 1.0.1.200 is vulnerable other versions may also be affected.

• http://sites.google.com/site/zhaojieding2/
• http://www.securityfocus.com/archive/1/520302
• http://www.securityfocus.com/bid/50441

---

Updated on 2015-03-25