Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Allied Telesyn AT‑TFTP server can crash or be hijacked

CVE-2006-6184 · published 19 years ago
Summary

The AT‑TFTP file‑transfer program (version 1.9 and earlier) can be tricked by sending a very long file name in a GET or PUT request. This can make the server stop working or allow an attacker to run their own code on the machine. Update the software or stop using the service until a patch is applied.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
alliedtelesyn at-tftp <= 1.9
cpe:2.3:a:alliedtelesyn:at-tftp:*:*:*:*:*:*:*:*
Original advisory text
Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a ...
Multiple stack-based buffer overflows in Allied Telesyn TFTP Server (AT-TFTP) 1.9, and possibly earlier, allow remote attackers to cause a denial of service (crash) or execute arbitrary code via a long filename in a (1) GET or (2) PUT command.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
67% chance of attack within 30 days
Timeline
Published1 Dec 2006
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2006-6184 · NVD
Track software like this
Free during beta