CVE-2021-46671

What it actually does

Out-of-bounds read in options.c allows a remote client to retrieve contents of the server-side /etc/group file via crafted TFTP option requests.

Why it matters to the business

Attackers can obtain sensitive group account information from exposed atftp servers without authentication, increasing the risk of targeted follow-on attacks.

How an attack unfolds

An unauthenticated remote attacker sends specially crafted TFTP option packets that trigger an array overrun in options.c, causing the server to return portions of /etc/group in the response.

How to fix it

Upgrade atftp to version 0.7.5 or later. Where upgrade is not immediately possible, restrict network access to the TFTP service or replace it with a maintained implementation.

How to confirm the fix worked

Confirm atftp version is 0.7.5 or newer; attempt to reproduce the out-of-bounds read with a packet crafted to exceed the options array and verify no /etc/group data is returned.

Typical attack path

1. Identify an atftp server listening on UDP port 69
2. Send malformed TFTP option requests that exceed expected array bounds
3. Receive leaked /etc/group data in server responses
4. Use obtained group names for further reconnaissance or credential attacks

How to detect it

Review atftp process logs and network captures for unusually large or malformed option requests followed by responses containing /etc/group entries; inspect packet payloads for repeated option patterns that trigger the overrun.

What your security team should do

• Prioritize upgrade of all atftp instances to 0.7.5 or later
• Limit exposure of TFTP services to trusted networks only
• Monitor for unexpected outbound UDP responses from atftp servers containing group-related strings