CVE-2020-6097
📋 TL;DR
This vulnerability allows remote attackers to cause denial of service in atftpd servers by sending specially crafted RRQ-Multicast requests that trigger an assert() call, crashing the daemon. It affects systems running vulnerable versions of atftp 0.7.git20120829-3.1+b1. Organizations using atftpd for TFTP services are impacted.
💻 Affected Systems
- atftp
📦 What is this software?
Atftp by Atftp Project
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of TFTP services, potentially affecting network boot processes, configuration file transfers, or firmware updates that rely on atftpd.
Likely Case
Service outage of atftpd daemon requiring manual restart, disrupting TFTP-dependent operations until recovery.
If Mitigated
Minimal impact if atftpd is not internet-facing and network access is restricted; service interruption limited to internal network segments.
🎯 Exploit Status
Exploitation requires sending malicious RRQ-Multicast packets to the atftpd service port (typically UDP 69).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in atftp 0.7.git20120829-3.1+b2 and later
Vendor Advisory: http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00058.html
Restart Required: Yes
Instructions:
1. Update atftp package using system package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade atftp. 3. For openSUSE: sudo zypper update atftp. 4. Restart atftpd service or reboot system.
🔧 Temporary Workarounds
Disable atftpd Service
linuxStop and disable the atftpd daemon if TFTP services are not required.
sudo systemctl stop atftpd
sudo systemctl disable atftpd
Network Access Control
linuxRestrict network access to atftpd using firewall rules to limit exposure.
sudo iptables -A INPUT -p udp --dport 69 -s trusted_network -j ACCEPT
sudo iptables -A INPUT -p udp --dport 69 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate atftpd servers from untrusted networks.
- Deploy intrusion detection/prevention systems to monitor for RRQ-Multicast attack patterns.
🔍 How to Verify
Check if Vulnerable:
Check atftp version: dpkg -l | grep atftp or rpm -q atftp. If version is 0.7.git20120829-3.1+b1 or earlier, system is vulnerable.Check Version:
dpkg -l | grep atftp # Debian/Ubuntu
rpm -q atftp # RHEL/CentOS/SUSE
apt-cache policy atftp # Alternative Debian/UbuntuVerify Fix Applied:
After update, verify version is 0.7.git20120829-3.1+b2 or later using same command. Test TFTP functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- atftpd crash logs
- assert() failure messages in system logs
- unexpected daemon termination
Network Indicators:
- Multiple RRQ-Multicast packets from single source
- UDP traffic on port 69 with abnormal request patterns
SIEM Query:
source="atftpd.log" AND ("assert" OR "crash" OR "terminated")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00058.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00014.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00058.html
- https://lists.debian.org/debian-lts-announce/2021/11/msg00014.html
- https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029
