CVE-2022-23121 — Improper Handling of Exceptional Conditions in Netatalk

CWE-755 — Improper Handling of Exceptional Conditions7 documents5 sources
Severity
9.8CRITICALNVD
OSV8.8
EPSS
20.8%
top 4.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
NetatalkDebian NetatalkDebian Linux
Timeline
PublishedMar 28
Latest updateJun 8

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages5 packages

▶debiandebian/netatalk< netatalk 3.1.12~ds-8+deb11u1 (bullseye)
▶NVDnetatalk/netatalk< 3.1.13
▶Debiannetatalk/netatalk< 3.1.12~ds-8+deb11u1+2
▶Ubuntunetatalk/netatalk< 3.1.12~ds-4ubuntu0.20.04.1+4
▶CVEListV5netatalk/netatalk3.1.12

Also affects: Debian Linux 10.0, 11.0

🔴Vulnerability Details

4
OSV
netatalk vulnerabilities↗2023-06-08
▶
OSV
CVE-2022-23121: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk↗2023-03-28
▶
GHSA
GHSA-8cm2-f4g9-wjfm: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk↗2023-03-28
▶
OSV
CVE-2022-23121: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk↗2022-03-21
▶

📋Vendor Advisories

2
Ubuntu
Netatalk vulnerabilities↗2023-06-08
▶
Debian
CVE-2022-23121: netatalk - This vulnerability allows remote attackers to execute arbitrary code on affected...↗2022
▶