Skip to content
OpenAdvisories
High USN-6334-1 3 CVEs

atftp vulnerabilities

Published Sep 4, 2023 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

Peter Wang discovered that atftp did not properly manage certain inputs. A
remote attacker could send a specially crafted tftp request to the server
to cause a crash. (CVE-2020-6097)

Andreas B. Mundt discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server to cause a crash. (CVE-2021-41054)

Johannes Krupp discovered that atftp did not properly manage certain
inputs. A remote attacker could send a specially crafted tftp request to
the server and make the server to disclose /etc/group data.
(CVE-2021-46671)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS atftp 0.7.git20120829-3.1ubuntu0.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS atftp 0.7.git20120829-3.1~0.16.04.1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS atftp 0.7.git20120829-3.1~0.18.04.1+esm1

Vulnerabilities 3

  • High 7.5
    CVE-2020-6097

    An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b…

    atftp atftp Debian Ubuntu
  • Unscored —
    CVE-2021-41054

    tftpd_file.c in atftp through 0.7.4 has a buffer overflow because buffer-size handling does not properly consider the c…

    atftp atftp Debian Ubuntu
  • Unscored —
    CVE-2021-46671

    options.c in atftp before 0.7.5 reads past the end of an array, and consequently discloses server-side /etc/group data …

    atftp atftp Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2020-6097
  • report
    https://ubuntu.com/security/CVE-2021-41054
  • report
    https://ubuntu.com/security/CVE-2021-46671