Netatalk Security Advisory
| Subject | Arbitrary code execution in parse_entries |
|---|---|
| CVE ID# | CVE-2022-23121 |
| Date | 2022/03/21 advisory published retroactively; date is approximate |
| Versions | 3.0.0 - 3.1.12, 1.5.0 - 2.2.6 |
| Summary | Lack of proper error handling leads to remote code execution in the parse_entries function |
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root.
Patch Availability
Apply the patches with git hashes 0c0465e and 62d4013 to hotfix your local Netatalk deployment.
Additionally, Netatalk 3.1.13 and 2.2.7 have been released which contains the security patch. Netatalk administrators are advised to upgrade to this version or apply the patch as soon as possible.
CVSS Calculation
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8)
Workaround
Configure Netatalk to use Extended Attributes (EA) instead of AppleDouble v2 to store metadata. This is the default configuration in Netatalk 3.0 and later.
Credits
Vulnerability found and reported by:
NCC Group EDG (Alex Plaskett, Cedric Halbronn, Aaron Adams)
Patch developed by:
Ralph Boehme of the Netatalk and Samba teams
Go back to the Security Policy.
