This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade netatalk | Aug 22, 2024 | Mar 28, 2023 |
| Debian | — | Upgrade netatalk | May 18, 2023 | Mar 28, 2023 |
| Gentoo Linux | — | Upgrade net-fs/netatalk. | Nov 2, 2023 | Mar 28, 2023 |
| Suse | — | Upgrade netatalkUpgrade netatalk-develUpgrade libatalk12 | Oct 26, 2022 | Apr 13, 2022 |
| Ubuntu | — | Upgrade netatalk (Ubuntu Pro)Upgrade netatalk | Jun 9, 2023 | Mar 28, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub