Ubuntu Security Notice 4540-1 - Denis Andzakovic discovered that atftpd incorrectly handled certain malformed packets. A remote attacker could send a specially crafted packet to cause atftpd to crash, resulting in a denial of service. Denis Andzakovic discovered that atftpd did not properly lock the thread list mutex. An attacker could send a large number of tftpd packets simultaneously when running atftpd in daemon mode to cause atftpd to crash, resulting in a denial of service. Various other issues were also addressed.
795f3cef45822be0c6f85455334f008d9e5c155d64359a0af3f53e85769f76e2
==========================================================================
Ubuntu Security Notice USN-4540-1
September 24, 2020
atftp vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in atftpd.
Software Description:
- atftp: Advanced TFTP Server and Client
Details:
Denis Andzakovic discovered that atftpd incorrectly handled certain
malformed packets. A remote attacker could send a specially crafted packet
to cause atftpd to crash, resulting in a denial of service.
(CVE-2019-11365)
Denis Andzakovic discovered that atftpd did not properly lock the thread
list mutex. An attacker could send a large number of tftpd packets
simultaneously when running atftpd in daemon mode to cause atftpd to
crash, resulting in a denial of service. (CVE-2019-11366)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
atftpd 0.7.git20120829-3.1~0.18.04.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4540-1
CVE-2019-11365, CVE-2019-11366
Package Information:
https://launchpad.net/ubuntu/+source/atftp/0.7.git20120829-3.1~0.18.04.1