Reachable Assertion in atftp - CVE-2020-6097
Published: August 27, 2020 / Updated: September 4, 2023
Vulnerability identifier: #VU46106
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-6097
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a reachable assertion in the atftpd daemon functionality. A remote attacker can use a specially crafted sequence of RRQ-Multicast requests to trigger an assert() call and cause a denial of service conditon on the target system.
Affected software
atftp
Arch Linux
Opensuse
Ubuntu
atftpd (Ubuntu package)
Dell EMC VxRail Appliance
Arch Linux
Opensuse
Ubuntu
atftpd (Ubuntu package)
Dell EMC VxRail Appliance
How to mitigate CVE-2020-6097
Install update from vendor's website.
atftp - update to 0.7.5
atftpd (Ubuntu package) - addressed in versions Ubuntu Pro, 0.7.git20120829-3.1ubuntu0.1
Dell EMC VxRail Appliance - update to 7.0.240
atftpd (Ubuntu package) - addressed in versions Ubuntu Pro, 0.7.git20120829-3.1ubuntu0.1
Dell EMC VxRail Appliance - update to 7.0.240