Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ubuntuUbuntuUSN-6146-1
HistoryJun 08, 2023 - 12:00 a.m.

Netatalk vulnerabilities

2023-06-0800:00:00
ubuntu.com
33
netatalk
ubuntu
vulnerabilities
remote attackers
arbitrary code
elevated privileges
cve-2021-31439
cve-2022-0194
cve-2022-23121
cve-2022-23122
cve-2022-23123
cve-2022-23124
cve-2022-23125
cve-2022-43634
cve-2022-45188
apple filing protocol service

CVSS2

5.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9

Confidence

Low

EPSS

0.101

Percentile

95.0%

JSON

Releases

  • Ubuntu 22.10
  • Ubuntu 22.04 LTS
  • Ubuntu 20.04 LTS
  • Ubuntu 18.04 ESM
  • Ubuntu 16.04 ESM
  • Ubuntu 14.04 ESM

Packages

  • netatalk - Apple Filing Protocol service

Details

It was discovered that Netatalk did not properly validate the length of
user-supplied data in the DSI structures. A remote attacker could possibly
use this issue to execute arbitrary code with the privileges of the user
invoking the programs. This issue only affected Ubuntu 20.04 LTS and Ubuntu
22.04 LTS. (CVE-2021-31439)

It was discovered that Netatalk did not properly validate the length of
user-supplied data in the ad_addcomment function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-0194)

It was discovered that Netatalk did not properly handle errors when parsing
AppleDouble entries. A remote attacker could possibly use this issue to
execute arbitrary code with root privileges. This issue only affected
Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2022-23121)

It was discovered that Netatalk did not properly validate the length of
user-supplied data in the setfilparams function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-23122)

It was discovered that Netatalk did not properly validate the length of
user-supplied data in the getdirparams function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04
LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23123)

It was discovered that Netatalk did not properly validate the length of
user-supplied data in the get_finderinfo function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS and Ubuntu 22.04 LTS.
(CVE-2022-23124)

It was discovered that Netatalk did not properly validate the length of
user-supplied data in the copyapplfile function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, Ubuntu 18.04
LTS, Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2022-23125)

It was discovered that Netatalk did not properly validate the length of
user-supplied data in the dsi_writeinit function. A remote attacker could
possibly use this issue to execute arbitrary code with root privileges.
This issue only affected Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu
22.10. (CVE-2022-43634)

It was discovered that Netatalk did not properly manage memory under
certain circumstances. If a user were tricked into opening a specially
crafted .appl file, a remote attacker could possibly use this issue to
execute arbitrary code. (CVE-2022-45188)

OSVersionArchitecturePackageVersionFilename
Ubuntu22.10noarchnetatalk< 3.1.13~ds-2ubuntu0.22.10.1UNKNOWN
Ubuntu22.10noarchnetatalk-dbgsym< 3.1.13~ds-2ubuntu0.22.10.1UNKNOWN
Ubuntu22.04noarchnetatalk< 3.1.12~ds-9ubuntu0.22.04.1UNKNOWN
Ubuntu22.04noarchnetatalk-dbgsym< 3.1.12~ds-9ubuntu0.22.04.1UNKNOWN
Ubuntu20.04noarchnetatalk< 3.1.12~ds-4ubuntu0.20.04.1UNKNOWN
Ubuntu20.04noarchnetatalk-dbg< 3.1.12~ds-4ubuntu0.20.04.1UNKNOWN
Ubuntu18.04noarchnetatalk< 2.2.6-1ubuntu0.18.04.2+esm1UNKNOWN
Ubuntu18.04noarchnetatalk< 2.2.6-1ubuntu0.18.04.2UNKNOWN
Ubuntu18.04noarchnetatalk-dbg< 2.2.6-1ubuntu0.18.04.2UNKNOWN
Ubuntu16.04noarchnetatalk< 2.2.5-1ubuntu0.2+esm1UNKNOWN
Rows per page:
1-10 of 161

Related

nessus 14
openvas 32
mageia 2
osv 12
debian 4
thn 2
gentoo 1
cert 1
malwarebytes 1
slackware 3
fedora 3
veracode 9
zdi 11
cvelist 9
cve 9
debiancve 9
ubuntucve 9
prion 9
nvd 9
githubexploit 3
alpinelinux 9
nessus
nessus
Debian DLA-3426-1 : netatalk - LTS security update
2023-05-17 00:00:00
Ubuntu 16.04 ESM / 18.04 ESM / 20.04 LTS / 22.04 LTS : Netatalk vulnerabilities (USN-6146-1)
2023-06-08 00:00:00
GLSA-202311-02 : Netatalk: Multiple Vulnerabilities including root remote code execution
2023-11-01 00:00:00
openvas
openvas
Mageia: Security Advisory (MGASA-2023-0027)
2023-03-28 00:00:00
Debian: Security Advisory (DLA-3426-1)
2023-05-17 00:00:00
Ubuntu: Security Advisory (USN-6146-1)
2023-06-09 00:00:00
mageia
mageia
Updated netatalk packages fix security vulnerability
2023-02-07 03:06:39
Updated netatalk packages fix security vulnerability
2022-05-22 14:26:36
osv
osv
netatalk - security update
2023-05-17 00:00:00
netatalk vulnerabilities
2023-06-08 09:57:44
netatalk - security update
2023-09-20 00:00:00
debian
debian
[SECURITY] [DLA 3426-1] netatalk security update
2023-05-16 22:24:58
[SECURITY] [DSA 5503-1] netatalk security update
2023-09-20 17:47:57
[SECURITY] [DLA 3426-2] netatalk regression update
2023-06-01 17:49:40
thn
thn
QNAP Advises to Mitigate Remote Hacking Flaws Until Patches are Available
2022-04-28 04:26:00
Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager
2024-01-09 09:52:00
gentoo
gentoo
Netatalk: Multiple Vulnerabilities including root remote code execution
2023-11-01 00:00:00
cert
cert
Netatalk contains multiple error and memory management vulnerabilities
2022-11-16 00:00:00
malwarebytes
malwarebytes
QNAP customers urged to disable AFP to protect against severe vulnerabilities
2022-04-28 14:28:10
slackware
slackware
[slackware-security] netatalk
2023-09-14 02:16:05
[slackware-security] netatalk
2023-05-01 20:40:12
[slackware-security] netatalk
2023-01-13 20:39:17
fedora
fedora
[SECURITY] Fedora 36 Update: netatalk-3.1.14-3.fc36
2023-04-12 01:39:16
[SECURITY] Fedora 38 Update: netatalk-3.1.14-3.fc38
2023-04-15 02:15:39
[SECURITY] Fedora 37 Update: netatalk-3.1.14-3.fc37
2023-04-12 01:34:37
veracode
veracode
Remote Code Execution (RCE)
2022-03-31 11:39:35
Denial Of Services (DoS)
2023-05-08 15:39:03
Remote Code Execution
2022-03-30 23:20:28
zdi
zdi
Synology DiskStation Manager Netatalk dsi_doff Heap-based Buffer Overflow Remote Code Execution Vulnerability
2021-04-29 00:00:00
(Pwn2Own) Netatalk get_finderinfo Out-Of-Bounds Read Information Disclosure Vulnerability
2022-03-23 00:00:00
(Pwn2Own) Netatalk copyapplfile Stack-based Buffer Overflow Remote Code Execution Vulnerability
2022-03-23 00:00:00
cvelist
cvelist
CVE-2021-31439
2021-05-21 00:00:00
CVE-2022-23121
2023-03-28 00:00:00
CVE-2022-23122
2023-03-28 00:00:00
cve
cve
CVE-2021-31439
2021-05-21 15:15:07
CVE-2022-23122
2023-03-28 19:15:10
CVE-2022-23124
2023-03-28 19:15:10
debiancve
debiancve
CVE-2022-23125
2023-03-28 19:15:10
CVE-2022-45188
2022-11-12 05:15:12
CVE-2021-31439
2021-05-21 15:15:07
ubuntucve
ubuntucve
CVE-2022-23124
2022-03-21 00:00:00
CVE-2022-43634
2023-03-29 00:00:00
CVE-2022-23122
2022-03-21 00:00:00
prion
prion
Stack overflow
2023-03-28 19:15:00
Design/Logic Flaw
2023-03-28 19:15:00
Heap overflow
2023-03-29 19:15:00
nvd
nvd
CVE-2022-23122
2023-03-28 19:15:10
CVE-2022-23121
2023-03-28 19:15:10
CVE-2022-23125
2023-03-28 19:15:10
githubexploit
githubexploit
Exploit for CVE-2022-23121
2022-05-28 05:48:35
Exploit for CVE-2022-23121
2022-05-12 20:58:01
Exploit for CVE-2022-23121
2022-05-12 20:58:01
alpinelinux
alpinelinux
CVE-2021-31439
2021-05-21 15:15:07
CVE-2022-23125
2023-03-28 19:15:10
CVE-2022-43634
2023-03-29 19:15:20

CVSS2

5.8

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9

Confidence

Low

EPSS

0.101

Percentile

95.0%

JSON
Related for USN-6146-1
nessus14openvas32mageia2osv12debian4thn2gentoo1cert1malwarebytes1slackware3fedora3veracode9zdi11cvelist9cve9debiancve9ubuntucve9prion9nvd9githubexploit3alpinelinux9