mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-30 22:11:59 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/atftp: add security fix for CVE-2020-6097

Browse Source 
Fixed the following security issue:

- CVE-2020-6097: An exploitable denial of service vulnerability exists in
  the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1.  A
  specially crafted sequence of RRQ-Multicast requests trigger an assert()
  call resulting in denial-of-service.  An attacker can send a sequence of
  malicious packets to trigger this vulnerability.

For more details, see the report:
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
This commit is contained in:
Peter Korsgaard
2021-02-05 10:01:01 +01:00
committed by Yann E. MORIN
parent b5aab68465
commit 5b36e91fda
2 changed files with 107 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
package/atftp/atftp.mk
View File

@@ -18,6 +18,9 @@ ATFTP_LIBS = -lpthread
ATFTP_CONF_ENV = LIBS="$(ATFTP_LIBS)" \
CFLAGS="$(TARGET_CFLAGS) -fgnu89-inline"
# 0004-Fix-for-DoS-issue-CVE-2020-6097.patch
ATFTP_IGNORE_CVES += CVE-2020-6097
ifeq ($(BR2_PACKAGE_READLINE),y)
ATFTP_DEPENDENCIES += readline
ATFTP_CONF_OPTS += --enable-libreadline