CVE-2022-23121
published 2023-03-28CVE-2022-23121: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
8.53%
94.4th percentile
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | netatalk | < netatalk 3.1.12~ds-8+deb11u1 (bullseye) | netatalk 3.1.12~ds-8+deb11u1 (bullseye) |
| netatalk | netatalk | < 3.1.13 | 3.1.13 |
| netatalk | netatalk | — | — |
| netatalk | netatalk | >= 0 < 3.1.12~ds-8+deb11u1 | 3.1.12~ds-8+deb11u1 |
| netatalk | netatalk | >= 0 < 3.1.13~ds-1 | 3.1.13~ds-1 |
| netatalk | netatalk | >= 0 < 3.1.13~ds-1 | 3.1.13~ds-1 |
| netatalk | netatalk | >= 0 < 3.1.12~ds-4ubuntu0.20.04.1 | 3.1.12~ds-4ubuntu0.20.04.1 |
| netatalk | netatalk | >= 0 < 3.1.12~ds-9ubuntu0.22.04.1 | 3.1.12~ds-9ubuntu0.22.04.1 |
| netatalk | netatalk | >= 0 < 2.2.2-1ubuntu2.2+esm1 | 2.2.2-1ubuntu2.2+esm1 |
| netatalk | netatalk | >= 0 < 2.2.5-1ubuntu0.2+esm1 | 2.2.5-1ubuntu0.2+esm1 |
| netatalk | netatalk | >= 0 < 2.2.6-1ubuntu0.18.04.2+esm1 | 2.2.6-1ubuntu0.18.04.2+esm1 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerable function is `parse_entries` in Netatalk; monitor for crashes or unexpected code execution originating from AppleDouble entry parsing in the Netatalk AFP daemon (afpd), particularly from unauthenticated remote connections. ↗
- →No authentication is required to trigger this vulnerability; any unauthenticated connection to the Netatalk AFP service attempting to send malformed AppleDouble entries should be treated as suspicious. ↗
- →Successful exploitation results in code execution as root; monitor for unexpected root-level process spawning from the Netatalk/afpd process. ↗
- ·Debian bullseye fix is available; ensure Netatalk is updated to 3.1.12~ds-8+deb11u1 or later on bullseye systems. ↗
- ·Debian forky, sid, and trixie fix is available; ensure Netatalk is updated to 3.1.13~ds-1 or later. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
netatalk vulnerabilities
osv·2023-06-08·CVSS 8.8
CVE-2021-31439 [HIGH] netatalk vulnerabilities
netatalk vulnerabilities
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the DSI structures. A remote attacker could possibly
use this issue to execute arbitrary code with the privileges of the user
invoking the programs. This issue only affected Ubuntu 20.04 LTS and Ubuntu
22.04 LTS. (CVE-2021-31439)
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the ad_addcomment function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-0194)
It was discovered that Netatalk did not properly handle errors when parsing
AppleDouble entries. A remote attacker could possibly use this issue to
ex
OSV
CVE-2022-23121: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk
osv·2023-03-28·CVSS 9.8
CVE-2022-23121 [CRITICAL] CVE-2022-23121: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.
GHSA
GHSA-8cm2-f4g9-wjfm: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk
ghsa_unreviewed·2023-03-28
CVE-2022-23121 [CRITICAL] CWE-755 GHSA-8cm2-f4g9-wjfm: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.
OSV
CVE-2022-23121: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk
osv·2022-03-21·CVSS 9.8
CVE-2022-23121 [CRITICAL] CVE-2022-23121: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute
Ubuntu
Netatalk vulnerabilities
vendor_ubuntu·2023-06-08·CVSS 8.8
CVE-2022-23123 [HIGH] Netatalk vulnerabilities
Title: Netatalk vulnerabilities
Summary: Several security issues were fixed in Netatalk.
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the DSI structures. A remote attacker could possibly
use this issue to execute arbitrary code with the privileges of the user
invoking the programs. This issue only affected Ubuntu 20.04 LTS and Ubuntu
22.04 LTS. (CVE-2021-31439)
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the ad_addcomment function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-0194)
It was discovered that Netatalk did not properly handle errors when parsing
AppleDoub
Debian
CVE-2022-23121: netatalk - This vulnerability allows remote attackers to execute arbitrary code on affected...
vendor_debian·2022·CVSS 9.8
CVE-2022-23121 [CRITICAL] CVE-2022-23121: netatalk - This vulnerability allows remote attackers to execute arbitrary code on affected...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15819.
Scope: local
bullseye: resolved (fixed in 3.1.12~ds-8+deb11u1)
forky: resolved (fixed in 3.1.13~ds-1)
sid: resolved (fixed in 3.1.13~ds-1)
trixie: resolved (fixed in 3.1.13~ds-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.debian.org/debian-lts-announce/2023/05/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00000.htmlhttps://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.htmlhttps://security.gentoo.org/glsa/202311-02https://www.debian.org/security/2023/dsa-5503https://www.zerodayinitiative.com/advisories/ZDI-22-527/https://lists.debian.org/debian-lts-announce/2023/05/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2023/06/msg00000.htmlhttps://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.htmlhttps://security.gentoo.org/glsa/202311-02https://www.debian.org/security/2023/dsa-5503https://www.kb.cert.org/vuls/id/709991https://www.zerodayinitiative.com/advisories/ZDI-22-527/
2023-03-28
Published