Tutorial - TFTP File Access

##
TFTP File Access

### Summary

This vulnerability allows for file access via the `TFTP` service.

### Impact

Using this vulnerability, malicious users can gain unauthorized remote access to system or user files.

### Background

The `TFTP` (trivial file transfer protocol) service provides remote access to files, without asking for a password. It is typically used for the initialization of diskless computers, of X terminals, or of other dedicated hardware.

### The Problem

When the `TFTP` daemon does not limit access to specific files or hosts, a remote intruder can use the service to obtain copies of the password file or of other system or user files, or to remotely overwrite files.

### Resolution

Restrict `TFTP` access to only limited subtree of the file system. Consult your `tftpd` manual pages for details. Also, when no access restriction is possible, restrict `TFTP` access by using a TCP wrapper.

### Where can I read more about this?

See the Admin Guide to Cracking for an example of why this vulnerability is a problem.