Unrated severityNVD Advisory· Published Apr 20, 2019· Updated Aug 4, 2024
CVE-2019-11365
CVE-2019-11365
Description
An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
7- security.gentoo.org/glsa/202003-14mitrevendor-advisoryx_refsource_GENTOO
- usn.ubuntu.com/4540-1/mitrevendor-advisoryx_refsource_UBUNTU
- www.debian.org/security/2019/dsa-4438mitrevendor-advisoryx_refsource_DEBIAN
- lists.debian.org/debian-lts-announce/2019/05/msg00012.htmlmitremailing-listx_refsource_MLIST
- pulsesecurity.co.nz/advisories/atftpd-multiple-vulnerabilitiesmitrex_refsource_MISC
- seclists.org/bugtraq/2019/May/16mitremailing-listx_refsource_BUGTRAQ
- sourceforge.net/p/atftp/code/ci/abed7d245d8e8bdfeab24f9f7f55a52c3140f96b/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.