CVE-2022-23124

NameCVE-2022-23124
DescriptionThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the get_finderinfo method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15870.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3426-1, DSA-5503-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
netatalk (PTS)buster3.1.12~ds-3vulnerable
buster (security)3.1.12~ds-3+deb10u5fixed
bullseye (security), bullseye3.1.12~ds-8+deb11u1fixed
sid, trixie3.1.18~ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
netatalksourcebuster3.1.12~ds-3+deb10u1DLA-3426-1
netatalksourcebullseye3.1.12~ds-8+deb11u1DSA-5503-1
netatalksource(unstable)3.1.13~ds-1

Notes

https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html
https://github.com/Netatalk/Netatalk/commit/4a8f6c964d5ca86df27c50e50dc1b60d39c9b76d
4a8f6c964d5ca86df27c50e50dc1b60d39c9b76d causes a regression:
https://sourceforge.net/p/netatalk/mailman/netatalk-devel/thread/49864b1b-6aa1-6859-3f53-a2018598b8ce%40synology.com/#msg37632074
Probably the same as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013303
3.1.13~ds-2 merged a patch: https://salsa.debian.org/netatalk-team/netatalk/-/commit/9b7e96c9023402d4f7aa49e28e13aef31aeb1caf
but not reviewed/merged upstream so far

Search for package or bug name: Reporting problems