CVE-2022-0194

NameCVE-2022-0194
DescriptionThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15876.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3426-1, DSA-5503-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
netatalk (PTS)bullseye3.1.12~ds-8+deb11u1fixed
bullseye (security)3.1.12~ds-8+deb11u2fixed
trixie4.0.6~ds-1fixed
sid4.0.7~ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
netatalksourcebuster3.1.12~ds-3+deb10u1DLA-3426-1
netatalksourcebullseye3.1.12~ds-8+deb11u1DSA-5503-1
netatalksource(unstable)3.1.13~ds-1

Notes

https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html
https://github.com/Netatalk/Netatalk/commit/4a8f6c964d5ca86df27c50e50dc1b60d39c9b76d
Causes a regression:
https://sourceforge.net/p/netatalk/mailman/netatalk-devel/thread/49864b1b-6aa1-6859-3f53-a2018598b8ce%40synology.com/#msg37632074
Probably the same as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013303
3.1.13~ds-2 merged a patch: https://salsa.debian.org/netatalk-team/netatalk/-/commit/9b7e96c9023402d4f7aa49e28e13aef31aeb1caf
but not reviewed/merged upstream so far

Search for package or bug name: Reporting problems