PT-2022-15865 · Netatalk+4 · Netatalk+4

Aaron Adams + 2 · Published 2022-03-21 · Updated 2024-12-26 · CVE-2022-23121

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Netatalk (affected versions not specified)

Description This issue allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this issue. The specific flaw exists within the parse entries function. The issue results from the lack of proper error handling when parsing AppleDouble entries. An attacker can leverage this issue to execute code in the context of root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

ALT-PU-2022-3105

ALT-PU-2023-1957

ALT-PU-2023-5152

ALT-PU-2023-5918

ALT-PU-2023-5932

ALT-PU-2023-5933

ALT-PU-2024-17688

CVE-2022-23121

DLA-3426-1

DLA-3426-2

DSA-5503-1

MGASA-2022-0196

MGASA-2023-0027

SUSE-SU-2022:1184-1

USN-6146-1

ZDI-22-527

Affected Products

Alt Linux

Linuxmint

Netatalk

Suse

Ubuntu

References · 57

• https://ubuntu.com/security/CVE-2022-45188 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-23121 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:1184-1 · Vendor Advisory
• https://debian.org/security/2023/dsa-5503 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23121 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23121 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/678469 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-23121 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-23121 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3426-2 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0027.html · Security Note
• https://ubuntu.com/security/CVE-2022-23124 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-0194 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-23121 · Vendor Advisory