CVE-2022-0194 — Stack-based Buffer Overflow in Netatalk
Severity
9.8CRITICALNVD
OSV8.8
EPSS
10.6%
top 6.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 28
Latest updateJun 8
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15876.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages5 packages
Also affects: Debian Linux 10.0, 11.0
🔴Vulnerability Details
4OSV▶
CVE-2022-0194: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk↗2023-03-28
GHSA▶
GHSA-j2hq-24xq-xcjr: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk↗2023-03-28
OSV▶
CVE-2022-0194: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk↗2022-03-21