USN-6334-1: atftp vulnerabilities

Packages

atftp - Advanced TFTP Server and Client

Details

Peter Wang discovered that atftp did not properly manage certain inputs. A
remote attacker could send a specially crafted tftp request to the server
to cause a crash. (CVE-2020-6097)

Andreas B. Mundt discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server to cause a crash. (CVE-2021-41054)

Johannes Krupp discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server and make the server to disclose /etc/group data.
(CVE-2021-46671)

Peter Wang discovered that atftp did not properly manage certain inputs. A
remote attacker could send a specially crafted tftp request to the server
to cause a crash. (CVE-2020-6097)

Andreas B. Mundt discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server to cause a crash. (CVE-2021-41054)

Johannes Krupp discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server and make the server to disclose /etc/group data.
(CVE-2021-46671)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

Ubuntu Release	Package Version
20.04 focal	atftpd – 0.7.git20120829-3.1ubuntu0.1
18.04 bionic	atftpd – 0.7.git20120829-3.1~0.18.04.1+esm1
16.04 xenial	atftpd – 0.7.git20120829-3.1~0.16.04.1+esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

Packages

Details

Update instructions

Reduce your security exposure

References