{"id":105610,"date":"2022-11-17T15:36:49","date_gmt":"2022-11-17T13:36:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda"},"modified":"2022-11-17T15:36:49","modified_gmt":"2022-11-17T13:36:49","slug":"kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/kriticheskie-uyazvimosti-v-netatalk-privodyashhie-k-udalyonnomu-vypolneniyu-koda","title":{"rendered":"Critical vulnerabilities in Netatalk leading to remote code execution","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In Netatalk, a server implementing AppleTalk and Apple Filing Protocol (AFP), six remotely exploitable vulnerabilities have been identified, allowing attackers to execute their code with root privileges by sending specially crafted packets. Netatalk is used by many network-attached storage (NAS) manufacturers for file sharing and printer access from Apple computers, for instance, it was used in Western Digital devices (the issue was resolved by removing Netatalk from WD firmware). Netatalk is also included in many distributions, including OpenWRT (removed starting from the OpenWrt 22.03 branch), Debian, Ubuntu, SUSE, Fedora, and FreeBSD, but is not used by default. The issues have been fixed in the Netatalk 3.1.13 release. <\/p>\n
Identified issues: <\/p>\n
\n
CVE-2022-0194 \u2014 lack of proper size validation of external data in the ad_addcomment() function before copying to a fixed buffer. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.\n
CVE-2022-23121 \u2014 improper error handling in the parse_entries() function occurring while parsing AppleDouble records. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.\n
CVE-2022-23122 \u2014 lack of proper size validation of external data in the setfilparams() function before copying to a fixed buffer. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.\n
CVE-2022-23124 \u2014 lack of proper input validation in the get_finderinfo() method, leading to reading from beyond the allocated buffer. This vulnerability allows a remote attacker to leak information from the process memory without authentication. In conjunction with other vulnerabilities, this flaw can also be exploited to execute code with root privileges.\n
CVE-2022-23125 \u2014 lack of size validation when parsing the 'len' element in the copyapplfile() function before copying data to a fixed buffer. This vulnerability allows a remote attacker to execute their code with root privileges without authentication.\n
CVE-2022-23123 \u2014 lack of validation for incoming external data in the getdirparams() method, leading to reading from beyond the allocated buffer. This vulnerability allows a remote attacker to leak information from the process memory without authentication. <\/ul>\n