CVE-2022-23123
published 2023-03-28CVE-2022-23123: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit…
PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.85%
88.8th percentile
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15830.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | netatalk | < netatalk 3.1.12~ds-8+deb11u1 (bullseye) | netatalk 3.1.12~ds-8+deb11u1 (bullseye) |
| netatalk | netatalk | < 3.1.13 | 3.1.13 |
| netatalk | netatalk | — | — |
| netatalk | netatalk | >= 0 < 3.1.12~ds-8+deb11u1 | 3.1.12~ds-8+deb11u1 |
| netatalk | netatalk | >= 0 < 3.1.13~ds-1 | 3.1.13~ds-1 |
| netatalk | netatalk | >= 0 < 3.1.13~ds-1 | 3.1.13~ds-1 |
| netatalk | netatalk | >= 0 < 3.1.12~ds-4ubuntu0.20.04.1 | 3.1.12~ds-4ubuntu0.20.04.1 |
| netatalk | netatalk | >= 0 < 3.1.12~ds-9ubuntu0.22.04.1 | 3.1.12~ds-9ubuntu0.22.04.1 |
| netatalk | netatalk | >= 0 < 2.2.2-1ubuntu2.2+esm1 | 2.2.2-1ubuntu2.2+esm1 |
| netatalk | netatalk | >= 0 < 2.2.5-1ubuntu0.2+esm1 | 2.2.5-1ubuntu0.2+esm1 |
| netatalk | netatalk | >= 0 < 2.2.6-1ubuntu0.18.04.2+esm1 | 2.2.6-1ubuntu0.18.04.2+esm1 |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerable code path is within the `getdirparams` method in Netatalk; monitor or audit calls to this function for out-of-bounds read conditions triggered by unauthenticated remote input. ↗
- →No authentication is required to trigger this vulnerability; any unauthenticated AFP/Netatalk network traffic targeting the getdirparams code path should be treated as suspicious. ↗
- →This vulnerability can be chained with other bugs to achieve remote code execution as root; treat any Netatalk exploitation attempt as a potential privilege escalation chain. ↗
- ·Debian bullseye fix is available; ensure Netatalk is updated to at least 3.1.12~ds-8+deb11u1 on bullseye systems. ↗
- ·Debian forky, sid, and trixie fix is available; ensure Netatalk is updated to at least 3.1.13~ds-1 on those systems. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.05.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_ubuntu8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
netatalk vulnerabilities
osv·2023-06-08·CVSS 8.8
CVE-2021-31439 [HIGH] netatalk vulnerabilities
netatalk vulnerabilities
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the DSI structures. A remote attacker could possibly
use this issue to execute arbitrary code with the privileges of the user
invoking the programs. This issue only affected Ubuntu 20.04 LTS and Ubuntu
22.04 LTS. (CVE-2021-31439)
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the ad_addcomment function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-0194)
It was discovered that Netatalk did not properly handle errors when parsing
AppleDouble entries. A remote attacker could possibly use this issue to
ex
OSV
CVE-2022-23123: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk
osv·2023-03-28·CVSS 9.8
CVE-2022-23123 [CRITICAL] CVE-2022-23123: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15830.
GHSA
GHSA-8x8m-c4qf-453q: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk
ghsa_unreviewed·2023-03-28
CVE-2022-23123 [CRITICAL] CWE-125 GHSA-8x8m-c4qf-453q: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15830.
OSV
CVE-2022-23123: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk
osv·2022-03-21·CVSS 9.8
CVE-2022-23123 [CRITICAL] CVE-2022-23123: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15830. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validat
Ubuntu
Netatalk vulnerabilities
vendor_ubuntu·2023-06-08·CVSS 8.8
CVE-2022-23123 [HIGH] Netatalk vulnerabilities
Title: Netatalk vulnerabilities
Summary: Several security issues were fixed in Netatalk.
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the DSI structures. A remote attacker could possibly
use this issue to execute arbitrary code with the privileges of the user
invoking the programs. This issue only affected Ubuntu 20.04 LTS and Ubuntu
22.04 LTS. (CVE-2021-31439)
It was discovered that Netatalk did not properly validate the length of
user-supplied data in the ad_addcomment function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-0194)
It was discovered that Netatalk did not properly handle errors when parsing
AppleDoub
Debian
CVE-2022-23123: netatalk - This vulnerability allows remote attackers to disclose sensitive information on ...
vendor_debian·2022·CVSS 9.8
CVE-2022-23123 [CRITICAL] CVE-2022-23123: netatalk - This vulnerability allows remote attackers to disclose sensitive information on ...
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-15830.
Scope: local
bullseye: resolved (fixed in 3.1.12~ds-8+deb11u1)
forky: resolved (fixed in 3.1.13~ds-1)
sid: resolved (fixed in 3.1.13~ds-1)
trixie: resolved (fixed in 3.1.13~ds-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.debian.org/debian-lts-announce/2023/05/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00016.htmlhttps://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.htmlhttps://security.gentoo.org/glsa/202311-02https://www.debian.org/security/2023/dsa-5503https://www.zerodayinitiative.com/advisories/ZDI-22-528/https://lists.debian.org/debian-lts-announce/2023/05/msg00018.htmlhttps://lists.debian.org/debian-lts-announce/2023/08/msg00016.htmlhttps://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.htmlhttps://security.gentoo.org/glsa/202311-02https://www.debian.org/security/2023/dsa-5503https://www.kb.cert.org/vuls/id/709991https://www.zerodayinitiative.com/advisories/ZDI-22-528/
2023-03-28
Published