In Netatalk, a server implementing AppleTalk and Apple Filing Protocol (AFP), six remotely exploitable vulnerabilities have been identified, allowing attackers to execute their code with root privileges by sending specially crafted packets. Netatalk is used by many network-attached storage (NAS) manufacturers for file sharing and printer access from Apple computers, for instance, it was used in Western Digital devices (the issue was resolved by removing Netatalk from WD firmware). Netatalk is also included in many distributions, including OpenWRT (removed starting from the OpenWrt 22.03 branch), Debian, Ubuntu, SUSE, Fedora, and FreeBSD, but is not used by default. The issues have been fixed in the Netatalk 3.1.13 release.
Identified issues:
- CVE-2022-0194 — insufficient validation of external data size in the ad_addcomment() function before copying into a fixed buffer. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.
- CVE-2022-23121 — improper error handling in the parse_entries() function when parsing AppleDouble records. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.
- CVE-2022-23122 — lack of proper validation of external data size in the setfilparams() function before copying into a fixed buffer. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.
- CVE-2022-23124 — insufficient validation of input data in the get_finderinfo() method, leading to reading from areas beyond the allocated buffer. This vulnerability allows a remote attacker to leak information from the process's memory without authentication. Combined with other vulnerabilities, this error can also be exploited to execute code with root privileges.
- CVE-2022-23125 — lack of size checking when parsing the 'len' element in the copyapplfile() function before copying data into a fixed buffer. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.
- CVE-2022-23123 — absence of input validation in the getdirparams() method, leading to reading from memory outside the allocated buffer. This vulnerability allows a remote attacker to leak information from the process's memory without needing authentication.
Source: opennet.ru
