9.8

CVE-2019-11365

Exploit
An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Atftp Project ≫ Atftp Version0.7.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.29% 0.898
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://lists.debian.org/debian-lts-announce/2019/05/msg00012.html
https://pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilities
Third Party Advisory
Exploit
https://seclists.org/bugtraq/2019/May/16
https://security.gentoo.org/glsa/202003-14
https://sourceforge.net/p/atftp/code/ci/abed7d245d8e8bdfeab24f9f7f55a52c3140f96b/
Patch
Third Party Advisory
https://usn.ubuntu.com/4540-1/
https://www.debian.org/security/2019/dsa-4438