| Name | CVE-2022-0194 |
| Description | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15876. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-3426-1, DSA-5503-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| netatalk (PTS) | stretch (security), stretch (lts), stretch | 2.2.5-2+deb9u1 | vulnerable |
| buster (security), buster, buster (lts) | 3.1.12~ds-3+deb10u5 | fixed | |
| bullseye (security), bullseye | 3.1.12~ds-8+deb11u1 | fixed | |
| sid, trixie | 4.0.6~ds-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| netatalk | source | stretch | (unfixed) | end-of-life | ||
| netatalk | source | buster | 3.1.12~ds-3+deb10u1 | DLA-3426-1 | ||
| netatalk | source | bullseye | 3.1.12~ds-8+deb11u1 | DSA-5503-1 | ||
| netatalk | source | (unstable) | 3.1.13~ds-1 |
https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html
https://github.com/Netatalk/Netatalk/commit/4a8f6c964d5ca86df27c50e50dc1b60d39c9b76d
Causes a regression:
https://sourceforge.net/p/netatalk/mailman/netatalk-devel/thread/49864b1b-6aa1-6859-3f53-a2018598b8ce%40synology.com/#msg37632074
Probably the same as https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1013303
3.1.13~ds-2 merged a patch: https://salsa.debian.org/netatalk-team/netatalk/-/commit/9b7e96c9023402d4f7aa49e28e13aef31aeb1caf
but not reviewed/merged upstream so far