CVE-2019-11366: NULL Pointer Dereference

An issue was discovered in atftpd in atftp 0.7.1. It does not lock the threadlistmutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If threaddata is NULL when assigned to current, a...

CVE-2019-11365: Out-of-bounds Write

An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this...

PT-2019-2187 · Atftp +3 · Atftp +3

Name of the Vulnerable Software and Affected Versions: atftp version 0.7.1 Description: The issue is related to the thread list mutex mutex in the atftpd component of atftp. It does not properly lock the mutex before assigning the current thread data structure, leading to a potential denial of...

Debian GNU/Linux Data Compromise

The multiple vulnerabilities in the atftpd package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Atftpd 0.6 - Remote Root Exploit (atftpdx.c)

No description provided by source. / PoC linux/86 remote exploit against atftpd c gunzip FIXED / include stdio.h include stdlib.h include unistd.h include string.h include netdb.h include sys/types.h include sys/socket.h include netinet/in.h include arpa/inet.h include signal.h define HEAPSTART...

Debian Security Advisory DSA 314-1 (atftp)

The remote host is missing an update to atftp announced via advisory DSA 314-1. OpenVAS Vulnerability Test $Id: deb3141.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 314-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

Debian Security Advisory DSA 314-1 (atftp)

The remote host is missing an update to atftp announced via advisory DSA 314-1. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Atftpd 0.6 Remote Root Exploit (atftpdx.c)

No description provided by source. / PoC linux/86 remote exploit against atftpd c gunzip FIXED / include stdio.h include stdlib.h include unistd.h include string.h include netdb.h include sys/types.h include sys/socket.h include netinet/in.h include arpa/inet.h include signal.h define HEAPSTART...

Debian DSA-314-1 : atftp - buffer overflow

Rick Patel discovered that atftpd is vulnerable to a buffer overflow when a long filename is sent to the server. An attacker could exploit this bug remotely to execute arbitrary code on the server. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in thi...

DEBIAN-CVE-2003-0380

Buffer overflow in atftp daemon atftpd 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long filename...

DSA-314 atftp - buffer overflow

Bulletin has no description...

CVE-2003-0380: Undefined Security Weakness

Buffer overflow in atftp daemon atftpd 0.6.1 and earlier, and possibly later versions, allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via a long filename...

Atftpd 0.6 - atftpdx.c Remote Command Execution

Atftpd 0.6 - atftpdx.c Remote Command Execution / PoC linux/86 remote exploit against atftpd c gunzip FIXED / include include include include include include include include include include define HEAPSTART 0x080514b4 define HEAPEND 0x080594b4 define BACKDOOR "rfe" / port MUST be 1024 / define...

Atftpd 0.6 Remote Root Exploit (atftpdx.c)

Exploit for linux platform in category remote exploits ========================================== Atftpd 0.6 Remote Root Exploit atftpdx.c ========================================== / PoC linux/86 remote exploit against atftpd c gunzip FIXED / include include include include include include inclu...

Atftpd 0.6 - 'atftpdx.c' Remote Command Execution

/ PoC linux/86 remote exploit against atftpd c gunzip FIXED / include include include include include include include include include include define HEAPSTART 0x080514b4 define HEAPEND 0x080594b4 define BACKDOOR "rfe" / port MUST be 1024 / define NOPNUM 128 / number of nops / define PORT 69 / tft...

atftpd buffer overflow

Buffer overflow on uploadnign file with oversized name...

possible remote buffer overflow in atftpd

Hello, There is possible remote buffer overflow in atftpd. It has to do with length of filename which client sends to atftpd server. If you send filename over 253 bytes, it crashes with segfault. When I attach to process with gdb I can see it trying to run instruction from EIP 0x41414141. That ca...