CVE-2019-11365

What it actually does

Stack-based buffer overflow in atftpd triggered by sending an error packet of 3 bytes or fewer, due to insecure strncpy usage in multiple files including tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c, enabling remote code execution.

Why it matters to the business

Remote attackers can fully compromise TFTP servers, leading to unauthorized access, data exfiltration, or denial of service across any environment using the affected software; the vulnerability has been public for years with public exploits available but stable low exploitation probability.

How an attack unfolds

An attacker sends a specially crafted TFTP error packet of three bytes or fewer to the atftpd listener, which mishandles the input via vulnerable strncpy calls and overwrites the stack, allowing arbitrary code execution; public exploits exist and could be adapted by threat actors though no named APT groups are associated.

How to fix it

Upgrade atftp to a version that addresses the strncpy issues in tftpd_file.c, tftp_file.c, tftpd_mtftp.c, and tftp_mtftp.c; if no patched release is available, replace with an alternative TFTP implementation or disable the service entirely.

How to confirm the fix worked

Confirm atftpd version is updated beyond 0.7.1, perform packet fuzzing tests with short error packets to verify absence of overflow, and review source for hardened string handling in the listed files.

Typical attack path

1. Identify exposed atftpd service via network scanning
2. Send crafted error packet of 3 bytes or fewer
3. Trigger stack-based buffer overflow via strncpy
4. Execute attacker-supplied shellcode
5. Establish remote control or install persistence

How to detect it

Inspect atftpd logs and network captures for inbound error packets of three bytes or fewer, monitor for unexpected process crashes or new child processes spawned by atftpd, and review system logs for unusual activity following TFTP sessions.

• atftpd
• short TFTP error packet
• tftpd_file.c

What your security team should do

• Immediately assess all instances of atftp and isolate or replace unpatched deployments
• Block or restrict inbound TFTP traffic from untrusted networks
• Monitor network traffic for anomalous small TFTP error packets
• Plan migration to a maintained TFTP server alternative