CVE-2021-44429
📋 TL;DR
CVE-2021-44429 is a buffer overflow vulnerability in Serva TFTP server that allows remote attackers to crash the daemon via specially crafted TFTP read requests. This affects Serva 4.4.0 installations with TFTP enabled. The vulnerability is related to a similar issue previously identified as CVE-2013-0145.
💻 Affected Systems
- Serva
📦 What is this software?
Serva by Vercot
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if buffer overflow can be controlled to execute arbitrary code.
Likely Case
Denial of service through daemon crash, disrupting TFTP services and potentially affecting PXE boot operations.
If Mitigated
Limited to service disruption if exploit only triggers crash without code execution.
🎯 Exploit Status
Public exploit code available on Packet Storm. TFTP protocol requires no authentication, making exploitation trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.0 or later
Vendor Advisory: https://www.vercot.com/~serva/
Restart Required: Yes
Instructions:
1. Download Serva 4.5.0 or later from official website. 2. Stop Serva service. 3. Install new version. 4. Restart Serva service.
🔧 Temporary Workarounds
Disable TFTP Service
windowsDisable TFTP functionality in Serva if not required for operations.
Edit Serva.ini and set TFTP=0
Restart Serva service
Network Segmentation
windowsRestrict TFTP port (69/UDP) access to trusted networks only.
Windows Firewall: New Inbound Rule blocking UDP port 69 from untrusted networks
🧯 If You Can't Patch
- Implement strict network access controls to limit TFTP port access to required systems only.
- Monitor Serva logs for crash events and implement alerting for service disruptions.
🔍 How to Verify
Check if Vulnerable:
Check Serva version in GUI or Serva.ini file for version 4.4.0.Check Version:
Check Serva.ini file or Serva GUI for version informationVerify Fix Applied:
Verify Serva version is 4.5.0 or later and test TFTP functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- Serva service crash logs
- TFTP error messages in Serva logs
- System event logs showing service termination
Network Indicators:
- Unusual TFTP traffic patterns
- Multiple TFTP RRQ requests from single source
- TFTP packets with malformed opcode 1
SIEM Query:
source="serva.log" AND ("crash" OR "error" OR "terminated") OR destination_port=69 AND protocol=UDP AND packet_size>512