CRITICAL🇵🇱 Wersja polska

CVE-2022-43634

CVSS 9.8v3.1pub. 2023-03-29upd. 2024-11-21

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsi_writeinit function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17646.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Netatalk

    APP
    Netatalk
    3.1.13
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2024-38441CRITICAL9.8PL ✓same product

Heap-based buffer overflow w Netatalk (off-by-one w FPMapName)

CVE-2024-38439CRITICAL9.8PL ✓same product

Netatalk: heap-based buffer overflow w obsłudze logowania FPLoginExt

CVE-2023-42464CRITICAL9.8PL ✓same product

Type Confusion w Netatalk afpd — możliwe RCE przez Spotlight RPC

CVE-2022-23121CRITICAL9.8PL ✓same product

Netatalk: RCE bez uwierzytelnienia przez błąd parsowania AppleDouble

CVE-2022-23122CRITICAL9.8PL ✓same product

RCE w Netatalk — stack-based buffer overflow w funkcji setfilparams