ATFTPD远程文件名长度缓冲区溢出漏洞

admin

0
文章

0
评论

2022-07-22 11:08:51 CNNVD漏洞来源：ZONE.CI 全球网 0 阅读模式

漏洞信息详情

ATFTPD远程文件名长度缓冲区溢出漏洞

CNNVD编号：CNNVD-200307-001
危害等级：高危
CVE编号： CVE-2003-0380
漏洞类型：缓冲区溢出
发布时间： 2003-07-02
威胁类型：远程
更新时间： 2005-10-20
厂商： atftpd
漏洞来源： .');">The discovery of t...

漏洞简介

Atftp daemon (atftpd) 0.6.1及其更早版本，可能还包括之后的版本存在缓冲区溢出漏洞。远程攻击者可以借助一个超长文件名导致服务拒绝（崩溃），并且可能执行任意代码。

漏洞公告

Gentoo has eliminated this vulnerability in their aftpd package. Users should run the following commands: emerge sync emerge atftp emerge clean Debian has released an advisory (DSA 314-1) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes. atftpd atftpd 0.6 .0

Debian atftp_0.6.0woody1_alpha.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _alpha.deb
Debian atftp_0.6.0woody1_arm.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _arm.deb
Debian atftp_0.6.0woody1_hppa.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _hppa.deb
Debian atftp_0.6.0woody1_i386.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _i386.deb
Debian atftp_0.6.0woody1_ia64.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _ia64.deb
Debian atftp_0.6.0woody1_m68k.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _m68k.deb
Debian atftp_0.6.0woody1_mips.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _mips.deb
Debian atftp_0.6.0woody1_mipsel.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _mipsel.deb
Debian atftp_0.6.0woody1_powerpc.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _powerpc.deb
Debian atftp_0.6.0woody1_s390.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _s390.deb
Debian atftp_0.6.0woody1_sparc.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1 _sparc.deb
Debian atftpd_0.6.0woody1_alpha.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_alpha.deb
Debian atftpd_0.6.0woody1_arm.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_arm.deb
Debian atftpd_0.6.0woody1_hppa.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_hppa.deb
Debian atftpd_0.6.0woody1_i386.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_i386.deb
Debian atftpd_0.6.0woody1_ia64.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_ia64.deb
Debian atftpd_0.6.0woody1_m68k.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_m68k.deb
Debian atftpd_0.6.0woody1_mips.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_mips.deb
Debian atftpd_0.6.0woody1_mipsel.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_mipsel.deb
Debian atftpd_0.6.0woody1_powerpc.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_powerpc.deb
Debian atftpd_0.6.0woody1_s390.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_s390.deb
Debian atftpd_0.6.0woody1_sparc.debDebian GNU/Linux 3.0 alias woody. http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody 1_sparc.deb

参考网址

来源: DEBIAN 名称: DSA-314 链接:http://www.debian.org/security/2003/dsa-314 来源: BUGTRAQ 名称: 20030606 atftpd bug 链接:http://archives.neohapsis.com/archives/bugtraq/2003-06/0056.HTML 来源: VULN-DEV 名称: 20030604 possible remote buffer overflow in atftpd 链接:http://www.securityfocus.com/archive/82/323886/2003-06-02/2003-06-08/0