CVE-2020-6097 Denial of service in atftpd
An attacker can cause a denial of service in the atftpd daemon by sending a specially crafted sequence of multicast requests, triggering an assertion failure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-6097?
CVE-2020-6097 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 10 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability.
Weakness: CWE-617
Which versions are affected by CVE-2020-6097?
It affects 3 products.
Linux distribution packages (1)
atftp openSUSE:Leap 15.2 | All versions | 0.7.2-lp152.2.3.1 |
Products include Atftp Project Atftp, Debian Debian Linux, Opensuse Leap.
How do I fix CVE-2020-6097?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-6097 being exploited?
There is no known exploitation of CVE-2020-6097 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-6097, GHSA-g854-fc3p-gq33, UBUNTU-CVE-2020-6097, openSUSE-SU-2020:1736-1.