ATFTPD远程文件名长度缓冲区溢出漏洞

漏洞信息详情

ATFTPD远程文件名长度缓冲区溢出漏洞

• CNNVD编号：CNNVD-200307-001
• 危害等级： 高危
  
  
• CVE编号：
  CVE-2003-0380
  
• 漏洞类型：
  
  
  缓冲区溢出
  
• 发布时间：
  
  2003-07-02
  
• 威胁类型：
  
  
  远程
  
• 更新时间：
  
  2005-10-20
  
• 厂        商：
  
  atftpd
• 漏洞来源：
  .’);”>The discovery of t…

Atftp daemon (atftpd) 0.6.1及其更早版本，可能还包括之后的版本存在缓冲区溢出漏洞。远程攻击者可以借助一个超长文件名导致服务拒绝（崩溃），并且可能执行任意代码。

Gentoo has eliminated this vulnerability in their aftpd package. Users should run the following commands:
emerge sync
emerge atftp
emerge clean
Debian has released an advisory (DSA 314-1) that addresses this issue. Please see the attached advisory for details on obtaining and applying fixes.
atftpd atftpd 0.6 .0

• Debian atftp_0.6.0woody1_alpha.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _alpha.deb
• Debian atftp_0.6.0woody1_arm.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _arm.deb
• Debian atftp_0.6.0woody1_hppa.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _hppa.deb
• Debian atftp_0.6.0woody1_i386.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _i386.deb
• Debian atftp_0.6.0woody1_ia64.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _ia64.deb
• Debian atftp_0.6.0woody1_m68k.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _m68k.deb
• Debian atftp_0.6.0woody1_mips.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _mips.deb
• Debian atftp_0.6.0woody1_mipsel.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _mipsel.deb
• Debian atftp_0.6.0woody1_powerpc.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _powerpc.deb
• Debian atftp_0.6.0woody1_s390.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _s390.deb
• Debian atftp_0.6.0woody1_sparc.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftp_0.6.0woody1
  _sparc.deb
• Debian atftpd_0.6.0woody1_alpha.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_alpha.deb
• Debian atftpd_0.6.0woody1_arm.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_arm.deb
• Debian atftpd_0.6.0woody1_hppa.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_hppa.deb
• Debian atftpd_0.6.0woody1_i386.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_i386.deb
• Debian atftpd_0.6.0woody1_ia64.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_ia64.deb
• Debian atftpd_0.6.0woody1_m68k.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_m68k.deb
• Debian atftpd_0.6.0woody1_mips.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_mips.deb
• Debian atftpd_0.6.0woody1_mipsel.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_mipsel.deb
• Debian atftpd_0.6.0woody1_powerpc.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_powerpc.deb
• Debian atftpd_0.6.0woody1_s390.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_s390.deb
• Debian atftpd_0.6.0woody1_sparc.debDebian GNU/Linux 3.0 alias woody.
  
  http://security.debian.org/pool/updates/main/a/atftp/atftpd_0.6.0woody
  1_sparc.deb

来源: DEBIAN
名称: DSA-314
链接:http://www.debian.org/security/2003/dsa-314

来源: BUGTRAQ
名称: 20030606 atftpd bug
链接:http://archives.neohapsis.com/archives/bugtraq/2003-06/0056.html

来源: VULN-DEV
名称: 20030604 possible remote buffer overflow in atftpd
链接:http://www.securityfocus.com/archive/82/323886/2003-06-02/2003-06-08/0