Netatalk vulnerabilities

A heap-based buffer overflow in the CNID daemon in Netatalk (versions 2.0.0-4.4.2) allows a remote authenticated attacker to execute arbitrary code with elevated privileges or cause a denial of service.

Netatalk versions 3.1.19 through 4.4.2 contain a stack-based buffer overflow in the deletedir() function of the afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. This allows unauthenticated attackers to perform an unbounded strcpy() operation with attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir() function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. copydir() is a utility function called when a file operation crosses a device boundary inside an AFP shared volume, which the standard library's renameat() cannot handle. The function attempts to track available buffer space using srem and drem for source and destination paths. Incorrect arithmetic causes both srem and drem to underflow to SIZE_MAX. Consequently, boundary checks against strlen(de->d_name) always pass, allowing strcpy() to append filenames into nearly full stack buffers. Version 4.4.3 patches the issue. As a workaround, configure each AFP shared volume to be structured as a single file system, in other words no subdirectory of a shared volume should be a mount point for a different file system.

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, potentially allowing a remote attacker to cause limited data modification under specific race conditions.

A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a fall-through from DSIOPT_ATTNQUANT to DSIOPT_SERVQUANT. A remote attacker can cause minor service disruption via crafted DSI session options.

Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple errors occur. A remote attacker can cause minor service disruption via conditions triggering incorrect error handling.

Netatalk versions 3.1.2 through 4.4.2 are compiled without FORTIFY_SOURCE, disabling built-in buffer overflow detection. A remote attacker can cause a minor denial of service via memory errors that would otherwise be safely terminated.

In Netatalk versions 3.0.0 through 4.4.2, a dead bounds check in the Spotlight RPC unmarshaller provides no effective bounds protection, potentially allowing a remote authenticated attacker to obtain limited information via crafted Spotlight RPC requests.

In Netatalk versions 2.0.0 through 4.4.2, an incorrect calculation in the hextoint macro due to improper uppercase character handling allows a remote authenticated attacker to cause limited data modification via crafted hexadecimal input.

A format string argument mismatch in Netatalk versions 3.0.3 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted input.

Insufficient sanitization of volume paths in Netatalk 3.1.0 through 4.4.2 allows a local privileged user to inject OS commands and execute arbitrary code via a crafted volume path.

Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions.

Vulnerability in Netatalk versions 2.2.1 through 4.4.2. The system() function is called after a failed chdir() without proper error handling, allowing a local privileged user to execute unintended commands or cause minor service disruption.

Unbounded memory reallocation in the charset conversion code in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to cause a minor denial of service via crafted character conversion requests.

An integer underflow vulnerability exists in the volxlate function of Netatalk versions 3.0.0 through 4.4.2. It allows a local privileged user to obtain limited information, modify limited data, or cause a minor service disruption via crafted volume translation input.

Vulnerability in Netatalk 2.1.0 through 4.4.2: incomplete sanitization of extended attribute (EA) path components allows remote authenticated attacker to write files outside intended metadata namespace via crafted EA names.

Netatalk versions 2.1.0 through 4.4.2 contain a heap over-read vulnerability in extended attribute (EA) header parsing. A remote authenticated attacker can use crafted EA data to obtain limited information or cause minor service disruption.

In Netatalk versions 3.1.0 through 4.4.2, multiple heap out-of-bounds reads exist in the Spotlight RPC deserialization code. A remote authenticated attacker can obtain sensitive information or cause minor service disruption.

An off-by-two error in lp_write() in papd in Netatalk 2.0.0 through 4.4.2 allows an adjacent network attacker to modify limited data or cause a minor service disruption via crafted print data.

An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.

Netatalk versions 2.1.0 through 4.4.2 contain an LDAP injection vulnerability. A remote authenticated attacker can manipulate LDAP queries, obtaining limited information or modifying LDAP entries via crafted filter input.

A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.

A vulnerability in Netatalk versions 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, allowing a remote attacker to recover authentication credentials via timing analysis.

An integer underflow vulnerability in the dsi_writeinit() function of Netatalk versions 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.

A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause minor service disruption.

An authentication bypass vulnerability in Netatalk versions 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.

A stack-based buffer overflow in desktop.c in Netatalk versions 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited information, or modify limited data.

A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.

Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of service by exploiting the reconnect mechanism.

Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, allowing a remote attacker to obtain authentication credentials or impersonate a user via cryptanalytic attack.

Netatalk versions 2.1.0 through 4.4.2 insert LDAP simple-bind passwords into log output in cleartext, allowing an attacker with access to log files to obtain LDAP credentials.

In Netatalk versions 3.0.2 through 4.4.2, an improper link resolution vulnerability allows a remote authenticated attacker to read or overwrite arbitrary files via attacker-controlled symlink creation.

In Netatalk versions 2.0.4 through 4.4.2, an out-of-bounds write due to improper null termination in convert_charset() allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.

Netatalk versions 2.0.4 through 4.4.2 contain a stack-based buffer overflow via UCS-2 type confusion in convert_charset(). A remote authenticated attacker can execute arbitrary code or cause a denial of service.

Netatalk versions 3.1.0 through 4.4.2 contain an SQL injection vulnerability in the MySQL CNID backend, allowing a remote authenticated attacker to access, modify data, or cause a denial of service.