ATFTP Timeout Command Line Argument Local Buffer Overflow Vulnerability

Bugtraq ID:	7902
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Jun 13 2003 12:00AM
Updated:	Jun 13 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to Julien Lanthea <[email protected]>.
Vulnerable:	atftp atftp 0.7 cvs
Not Vulnerable:

ATFTP Timeout Command Line Argument Local Buffer Overflow Vulnerability

atftp is prone to a locally exploitable buffer overflow condition. This issue is due to insufficient bounds checking performed on input supplied to the command line parameter (-t) for "timeout".

Local attackers may exploit this condition to execute arbitrary instructions.

It should be noted that although this vulnerability has been reported to affect atftp version 0.7cvs, other versions might also be vulnerable.

ATFTP Timeout Command Line Argument Local Buffer Overflow Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ATFTP Timeout Command Line Argument Local Buffer Overflow Vulnerability

References:

• Advanced TFTP Homepage (Remi Lefebvre)