{"vuid":"VU#709991","idnumber":"709991","name":"Netatalk contains multiple error and memory management vulnerabilities","keywords":null,"overview":"### Overview\r\nThere are six new vulnerabilities in the latest release of Netatalk (3.1.12) that could allow for Remote Code Execution as well as Out-of-bounds Read.\r\n\r\n### Description\r\nBelow are the new CVEs. Per ZDI: \r\n\r\n**CVE-2022-0194**\r\nThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability.\r\n\r\nThe specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\r\n\r\n**CVE-2022-23121**\r\nThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability.\r\n\r\nThe specific flaw exists within the parse_entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this vulnerability to execute code in the context of root.\r\n\r\n**CVE-2022-23122**\r\nThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability.\r\n\r\nThe specific flaw exists within the setfilparams function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\r\n\r\n**CVE-2022-23124**\r\nThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability.\r\n\r\nThe specific flaw exists within the get_finderinfo method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.\r\n\r\n**CVE-2022-23125**\r\nThis vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability.\r\n\r\nThe specific flaw exists within the copyapplfile function. When parsing the len element, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.\r\n\r\n**CVE-2022-23123**\r\nThis vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability.\r\n\r\nThe specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.\r\n\r\n\r\nFor more detailed information, please review the Netatalk announcement. Also available for reference are releases detailing the information from ZDI & Western Digital. \r\n\r\n\r\nNetatalk does not regularly receive security updates, is receiving security research attention, and is difficlut to get right because reverse engineering a proprietary protocol. WD has removed Netatalk code from NAS firmware. We suggest Samba+vfs_fruit for longer term use (more likely to get security updates in a timely way).\r\n(see samba vfs_fruit vuls).\r\n\r\n\r\n\r\n### Impact\r\nAn unauthenticated, remote attacker can execute arbitrary code on affected installations of Netatalk.\r\n\r\n### Solution\r\nNetatalk has released version [3.1.13](https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html). \r\n\r\n### Acknowledgements\r\nThanks to ZDI, Western Digital, and Netatalk for researching and coordinating these vulnerabilities. \r\n\r\nThis document was written by James Stanley and Art Manion.","clean_desc":null,"impact":null,"resolution":null,"workarounds":null,"sysaffected":null,"thanks":null,"author":null,"public":["https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html","https://www.westerndigital.com/support/product-security/wdc-22005-netatalk-security-vulnerabilities"],"cveids":["CVE-2022-23125","CVE-2022-23123","CVE-2022-23124","CVE-2022-23122","CVE-2022-23121","CVE-2022-0194"],"certadvisory":null,"uscerttechnicalalert":null,"datecreated":"2022-11-16T13:28:23.033293Z","publicdate":"2022-01-10T00:00:00Z","datefirstpublished":"2022-11-16T13:28:23.063553Z","dateupdated":"2023-04-04T14:19:11.138865Z","revision":4,"vrda_d1_directreport":null,"vrda_d1_population":null,"vrda_d1_impact":null,"cam_widelyknown":null,"cam_exploitation":null,"cam_internetinfrastructure":null,"cam_population":null,"cam_impact":null,"cam_easeofexploitation":null,"cam_attackeraccessrequired":null,"cam_scorecurrent":null,"cam_scorecurrentwidelyknown":null,"cam_scorecurrentwidelyknownexploited":null,"ipprotocol":null,"cvss_accessvector":null,"cvss_accesscomplexity":null,"cvss_authentication":null,"cvss_confidentialityimpact":null,"cvss_integrityimpact":null,"cvss_availabilityimpact":null,"cvss_exploitablity":null,"cvss_remediationlevel":null,"cvss_reportconfidence":null,"cvss_collateraldamagepotential":null,"cvss_targetdistribution":null,"cvss_securityrequirementscr":null,"cvss_securityrequirementsir":null,"cvss_securityrequirementsar":null,"cvss_basescore":null,"cvss_basevector":null,"cvss_temporalscore":null,"cvss_environmentalscore":null,"cvss_environmentalvector":null,"metric":null,"vulnote":78}