CVE-2006-6183
3Com 3CTftpSvc < 2.0.1 - Stack-Based Buffer Overflow via Long Mode Field in GET or PUT Command
Title source: llmExploitation Summary
EIP tracks 6 public exploits for CVE-2006-6183.
PoCs published by Metasploit, Umesh Wanve, Enseirb, including Metasploit module exploits/windows/tftp/threectftpsvc_long_mode.
AI-analyzed exploit summary This Metasploit module exploits a stack buffer overflow in 3CTftpSvc 2.0.1 via a UDP packet with an overly long mode field, allowing arbitrary code execution. The exploit uses a known return address (0x00402b02) and includes NOP sleds and payload encoding.
Description
Multiple stack-based buffer overflows in 3Com 3CTftpSvc 2.0.1, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long mode field (aka transporting mode) in a (1) GET or (2) PUT command.
Exploits (6)
This Metasploit module exploits a stack buffer overflow in 3CTftpSvc 2.0.1 via a UDP packet with an overly long mode field, allowing arbitrary code execution. The exploit uses a known return address (0x00402b02) and includes NOP sleds and payload encoding.
This exploit targets a buffer overflow vulnerability in 3Com TFTP Service <= 2.0.1 by sending a maliciously crafted UDP packet with an overly long transporting mode name. The payload includes a NOP sled and shellcode to achieve remote code execution.
This exploit targets a stack-based buffer overflow in 3Com TFTP Server (3CTftpSvc) via a malformed TFTP Write Request (WRQ) packet with an overly long mode field. It leverages SEH overwrites for reliable code execution on Windows XP systems.
This exploit targets a buffer overflow in 3Com TFTP Service version 2.0.1 on Windows XP SP2 English. It sends a maliciously crafted TFTP packet with shellcode to achieve remote code execution via a bind shell on port 4444.
This exploit triggers a buffer overflow in 3CTftpSvc TFTP Server by sending a malformed TFTP request with an overly long mode field (469+ bytes). It is designed as a DoS but could potentially lead to arbitrary code execution under specific conditions.
This Metasploit module exploits a stack buffer overflow in 3CTftpSvc 2.0.1 by sending a crafted UDP packet with an overly long mode field, leading to arbitrary code execution. The exploit uses a known return address (0x00402b02) and includes NOP sleds and payload encoding.