Univention Bugzilla – Bug 49452
atftp: Multiple issues (4.4)
Last modified: 2019-05-15 14:52:34 CEST
New Debian atftp 0.7.git20120829-3.1~deb9u1 fixes: This update addresses the following issues: * An issue was discovered in atftpd in atftp 0.7.1. A remote attacker may send a crafted packet triggering a stack-based buffer overflow due to an insecurely implemented strncpy call. The vulnerability is triggered by sending an error packet of 3 bytes or fewer. There are multiple instances of this vulnerable strncpy pattern within the code base, specifically within tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c. (CVE-2019-11365) * An issue was discovered in atftpd in atftp 0.7.1. It does not lock the thread_list_mutex mutex before assigning the current thread data structure. As a result, the daemon is vulnerable to a denial of service attack due to a NULL pointer dereference. If thread_data is NULL when assigned to current, and modified by another thread before a certain tftpd_list.c check, there is a crash when dereferencing current->next. (CVE-2019-11366)
--- mirror/ftp/4.3/unmaintained/4.3-0/source/atftp_0.7.git20120829-3.dsc +++ apt/ucs_4.4-0-errata4.4-0/source/atftp_0.7.git20120829-3.1~deb9u1.dsc @@ -1,3 +1,14 @@ +0.7.git20120829-3.1~deb9u1 [Fri, 03 May 2019 18:51:14 +0200] Salvatore Bonaccorso <carnil@debian.org>: + + * Non-maintainer upload by the Security Team. + * Rebuild for stretch-security. + +0.7.git20120829-3.1 [Mon, 29 Apr 2019 19:37:52 +0200] Salvatore Bonaccorso <carnil@debian.org>: + + * Non-maintainer upload. + * Fix concurrency issue denial of service (CVE-2019-11366) (Closes: #927553) + * Fix error handler stack overflow (CVE-2019-11365) (Closes: #927553) + 0.7.git20120829-3 [Mon, 05 Sep 2016 19:00:41 +0200] Ludovic Drolez <ldrolez@debian.org>: * Ack previous NMU <http://10.200.17.11/4.4-0/#6850782879606683665>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.4-0] 1843c94ee1 Bug #49452: atftp 0.7.git20120829-3.1~deb9u1 doc/errata/staging/atftp.yaml | 22 ++++++++++------------ 1 file changed, 10 insertions(+), 12 deletions(-) [4.4-0] 3c7354da57 Bug #49452: atftp 0.7.git20120829-3.1~deb9u1 doc/errata/staging/atftp.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+)
<http://errata.software-univention.de/ucs/4.4/92.html>