CVE-2024-38439

The vulnerability occurs in the FPLoginExt function in the file etc/uams/uams_pam.c, where improper null termination (zeroing) is assigned to the element ibuf[PASSWDLEN] — an index one position beyond the declared password buffer boundary. This is a classic off-by-one error that causes overwriting of an adjacent byte on the heap. A remote attacker, by sending a specially crafted login request, can cause controlled heap memory structure corruption.

A remote, unauthenticated attacker can achieve arbitrary code execution (RCE) on a vulnerable system with Netatalk process privileges, as well as compromise the confidentiality, integrity, and availability of data.

Netatalk should be updated to version 3.2.1, 3.1.19, or 2.4.1 (depending on the branch in use). Patches are available in the project repository and are described in Security Advisory GHSA-8r68-857c-4rqc.

Netatalk in all versions before 3.2.1 (fixes were also introduced in versions 2.4.1 and 3.1.19)