USN-6334-1: atftp vulnerabilities
4 September 2023
Several security issues were fixed in atftp.
Releases
Packages
- atftp - Advanced TFTP Server and Client
Details
Peter Wang discovered that atftp did not properly manage certain inputs. A
remote attacker could send a specially crafted tftp request to the server
to cause a crash. (CVE-2020-6097)
Andreas B. Mundt discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server to cause a crash. (CVE-2021-41054)
Johannes Krupp discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server and make the server to disclose /etc/group data.
(CVE-2021-46671)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 20.04
Ubuntu 18.04
-
atftpd
-
0.7.git20120829-3.1~0.18.04.1+esm1
Available with Ubuntu Pro
Ubuntu 16.04
-
atftpd
-
0.7.git20120829-3.1~0.16.04.1+esm1
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.