PT-2002-3108 · Atftp · Atftp

Published 2002-12-31 · Updated 2008-09-05 · CVE-2002-2396

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions atftp versions 0.5 through 0.6

Description A buffer overflow issue exists, potentially allowing local users to execute arbitrary code via a long argument to the -g option, if installed setuid or setgid.

Recommendations For atftp versions 0.5 through 0.6, consider removing setuid or setgid installation to mitigate the risk of arbitrary code execution.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2002-2396

Affected Products

Atftp

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2002-2396 · Security Note
• http://iss.net/security_center/static/10142.php · Note
• http://securityfocus.com/bid/5760 · Note
• http://netric.org/advisories/netric-adv010.txt · Note