CVE-2019-11365: Buffer Overflow
An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpdfile.c, tftpfile.c, tftpdmtftp.c, and tftpmtftp.c.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-11365?
The severity of CVE-2019-11365 is critical with a CVSS score of 9.8.
How does CVE-2019-11365 impact atftpd in atftp?
CVE-2019-11365 allows a remote attacker to trigger a stack-based buffer overflow in atftpd in atftp 0.7.1.
How is CVE-2019-11365 triggered?
CVE-2019-11365 can be triggered by sending an error packet of 3 bytes or fewer to the vulnerable atftpd service.
What is the affected software for CVE-2019-11365?
The affected software for CVE-2019-11365 includes atftp versions 0.7.git20120829-3.2~deb10u3, 0.7.git20120829-3.3+deb11u2, and 0.8.0-3 in Debian, and atftp version 0.7.20120829-3.1~0.18.04.1 in Ubuntu 18.04 LTS (Bionic) and 0.7.20120829-3.1~0.16.04.1 in Ubuntu 16.04 LTS (Xenial).
How can CVE-2019-11365 be remediated?
To remediate CVE-2019-11365, it is recommended to update the atftp package to the fixed versions: 0.7.git20120829-3.2~deb10u3, 0.7.git20120829-3.3+deb11u2, or 0.8.0-3 in Debian, and 0.7.20120829-3.1~0.18.04.1 in Ubuntu 18.04 LTS (Bionic) or 0.7.20120829-3.1~0.16.04.1 in Ubuntu 16.04 LTS (Xenial).