Cloudanix VulnDB

CVE-2020-6097

High · 7.5

CVSS

7.5

EPSS

2.2%

Published

Sep 10, 2020

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in a file transfer program can be triggered by certain network messages, causing the program to crash and stop working until restarted.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Network Service
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Specially crafted sequences of RRQ-Multicast requests trigger an assert() call in the atftpd daemon, causing an immediate process crash and denial of service.

Why it matters to the business

Disruption of TFTP-based file transfer services can halt automated deployments, device provisioning, and network boot operations across Linux environments, leading to operational downtime.

How an attack unfolds

An attacker sends a crafted sequence of RRQ-Multicast packets over the network to the atftpd listener; the malformed request sequence hits an assert condition that terminates the daemon, and public exploit code is available to automate this.

How to fix it

Upgrade atftp to a version containing the fix for the assert handling in RRQ-Multicast processing; if no fixed package is yet available in the distribution, disable the atftpd service or restrict network access until an update can be applied.

How to confirm the fix worked

Confirm the atftpd process no longer crashes when replaying the previously triggering RRQ-Multicast sequence; monitor service logs and process uptime after applying updates.

Typical attack path

  1. Identify exposed atftpd instances via network scanning
  2. Craft and transmit a sequence of malicious RRQ-Multicast requests
  3. Observe daemon crash and service unavailability
  4. Repeat or maintain packet stream to sustain denial of service

How to detect it

Review atftpd and syslog logs for repeated RRQ request entries followed by abrupt process termination or assert-related messages; inspect network traffic captures for bursts of multicast TFTP requests from untrusted sources.

  • atftpd.*assert
  • RRQ.*multicast
  • tftp.*crash

What your security team should do

  • Prioritize patching or disabling atftpd on all affected Debian and openSUSE systems given the public exploit availability
  • Restrict TFTP access to trusted networks only
  • Monitor EPSS and exploit maturity indicators for any increase in observed attempts

The record

An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 atftp 0 0.7.git20120829-3.2
Debian:12 atftp 0 0.7.git20120829-3.2
Debian:13 atftp 0 0.7.git20120829-3.2
Debian:14 atftp 0 0.7.git20120829-3.2
Debian:9 atftp 0 0.7.git20120829-3.1~deb9u2
Ubuntu:20.04:LTS atftp 0 0.7.git20120829-3.1ubuntu0.1
Ubuntu:22.04:LTS atftp 0 0.7.git20210915-4
Ubuntu:Pro:16.04:LTS atftp 0 0.7.git20120829-3.1~0.16.04.1+esm1
Ubuntu:Pro:18.04:LTS atftp 0 0.7.git20120829-3.1~0.18.04.1+esm1
openSUSE:Leap 15.2 atftp 0 0.7.2-lp152.2.3.1
openSUSE:Tumbleweed atftp 0 0.7.5-1.1

Related vulnerabilities