An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4643-1 advisory.

    It was discovered that atftp's FTP server did not properly handler certain input. An attacker could use     this to to cause a denial of service (crash) or possibly execute arbitrary code. (CVE-2019-11365)

    It was discovered that atftp's FTP server did not make proper use of mutexes when locking certain data     structures. An attacker could use this to cause a denial of service via a NULL pointer dereference.
    (CVE-2019-11366)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4540-1 advisory.

    Denis Andzakovic discovered that atftpd incorrectly handled certain malformed packets. A remote attacker     could send a specially crafted packet to cause atftpd to crash, resulting in a denial of service.
    (CVE-2019-11365)

    Denis Andzakovic discovered that atftpd did not properly lock the thread list mutex. An attacker could     send a large number of tftpd packets simultaneously when running atftpd in daemon mode to cause atftpd to     crash, resulting in a denial of service. (CVE-2019-11366)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the atftp package has been released.

The remote host is affected by the vulnerability described in GLSA-202003-14 (atftp: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in atftp. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could send a specially crafted packet to an atftp       instance, possibly resulting in the execution of arbitrary code with the       privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Denis Andzakovic discovered two vulnerabilities in atftp, the advanced TFTP server which could result in denial of service by sending malformed packets.

For Debian 8 'Jessie', these problems have been fixed in version 0.7.git20120829-1+deb8u1.

We recommend that you upgrade your atftp packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Denis Andzakovic discovered two vulnerabilities in atftp, the advanced TFTP server which could result in denial of service by sending malformed packets.

This update for atftp fixes the following issues :

Security issues fixed :

CVE-2019-11366: Fixed a denial of service caused by a NULL pointer dereference because thread_list_mutex was not locked (bsc#1133145).

CVE-2019-11365: Fixed a buffer overflow which could lead to remote code execution caused by an insecure use of strncpy() (bsc#1133114).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
143242	Ubuntu 16.04 LTS : atftp vulnerabilities (USN-4643-1)	Nessus	Ubuntu Local Security Checks	critical
140787	Ubuntu 18.04 LTS : atftpd vulnerabilities (USN-4540-1)	Nessus	Ubuntu Local Security Checks	critical
138441	Photon OS 1.0: Atftp PHSA-2020-1.0-0306	Nessus	PhotonOS Local Security Checks	critical
138184	Photon OS 2.0: Atftp PHSA-2020-2.0-0257	Nessus	PhotonOS Local Security Checks	critical
134591	GLSA-202003-14 : atftp: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
124778	Debian DLA-1783-1 : atftp security update	Nessus	Debian Local Security Checks	critical
124683	Debian DSA-4438-1 : atftp - security update	Nessus	Debian Local Security Checks	critical
124406	SUSE SLES11 Security Update : atftp (SUSE-SU-2019:14033-1)	Nessus	SuSE Local Security Checks	critical
124405	SUSE SLED12 / SLES12 Security Update : atftp (SUSE-SU-2019:1091-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2019-11366

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical