Netatalk Security Advisory
| Subject | Arbitrary code execution in parse_entries |
|---|---|
| CVE ID# | CVE-2022-23121 |
| Date | 2022/03/21 advisory published retroactively; date is approximate |
| Versions | 3.0.0 - 3.1.12, 1.5.0 - 2.2.6 |
| Summary | Lack of proper error handling leads to remote code execution in the parse_entries function |
Description
This vulnerability allows remote attackers to execute arbitrary code on affected Netatalk installations without requiring authentication.
The flaw resides in the parse_entries function, where improper error handling occurs while parsing AppleDouble entries.
An attacker can exploit this vulnerability to execute code with root-level privileges.
Patch Availability
Apply the patches with git hashes 0c0465e and 62d4013 to hotfix your local Netatalk deployment.
Additionally, Netatalk 3.1.13 and 2.2.7 have been released which contains the security patch. Netatalk administrators are advised to upgrade to this version or apply the patch as soon as possible.
CVSS Calculation
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)
Workaround
Configure Netatalk to use Extended Attributes (EA) instead of AppleDouble v2 to store metadata. This is the default configuration in Netatalk 3.0 and later.
Credits
Vulnerability found and reported by:
NCC Group EDG (Alex Plaskett, Cedric Halbronn, Aaron Adams)
Patch developed by:
Ralph Boehme of the Netatalk and Samba teams
Go back to the Security Policy.
