[ GLSA 202003-14 ] atftp

[GLSA]

Gentoo Linux Security Advisory

Title: atftp: Multiple vulnerabilities (GLSA 202003-14)
Severity: high
Exploitable: remote
Date: 2020-03-14
Bug(s): #711630
ID: 202003-14

Synopsis

Multiple vulnerabilities have been found in atftp, the worst of
which could result in the execution of arbitrary code.


Background

atftp is a client/server implementation of the TFTP protocol that
implements RFCs 1350, 2090, 2347, 2348, and 2349.


Affected Packages

Package: net-ftp/atftp
Vulnerable: < 0.7.2
Unaffected: >= 0.7.2
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in atftp. Please review
the CVE identifiers referenced below for details.


Impact

A remote attacker could send a specially crafted packet to an atftp
instance, possibly resulting in the execution of arbitrary code with the
privileges of the process or a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All atftp users should upgrade to the latest version: