An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade atftp | May 8, 2019 | Apr 20, 2019 |
| Gentoo Linux | — | Upgrade net-ftp/atftp. | Mar 16, 2020 | Apr 20, 2019 |
| Suse | — | Upgrade atftp | Apr 30, 2019 | Apr 20, 2019 |
| Ubuntu | — | Upgrade atftpdUpgrade atftp | Sep 25, 2020 | Apr 20, 2019 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 20, 2019 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub