CVE-2020-6097 — Reachable Assertion in Project Atftp

CWE-617 — Reachable Assertion7 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 47.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Atftp Project AtftpDebian LinuxOpensuse Leap
Timeline
PublishedSep 10
Latest updateSep 4

Description

An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶Debianatftp_project/atftp< 0.7.git20120829-3.2+3
▶Ubuntuatftp_project/atftp< 0.7.git20120829-3.1ubuntu0.1+2
▶NVDatftp_project/atftp0.7.git20120829-3.1\+b1
▶NVDopensuse/leap15.2

Also affects: Debian Linux 9.0

🔴Vulnerability Details

4
OSV
atftp vulnerabilities↗2023-09-04
▶
GHSA
GHSA-g854-fc3p-gq33: An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0↗2022-05-24
▶
OSV
CVE-2020-6097: An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0↗2020-09-10
▶
CVEList
CVE-2020-6097: An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0↗2020-09-10
▶

📋Vendor Advisories

2
Ubuntu
atftp vulnerabilities↗2023-09-04
▶
Debian
CVE-2020-6097: atftp - An exploitable denial of service vulnerability exists in the atftpd daemon funct...↗2020
▶
CVE-2020-6097 — Reachable Assertion in Project Atftp | cvebase