CVE-2024-38439

2024-06-1613:15:53

[email protected]

web.nvd.nist.gov

netatalk 3.2.0

off-by-one error

heap-based buffer overflow

fploginext

7.6 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Netatalk 3.2.0 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[PASSWDLEN] to ‘\0’ in FPLoginExt in login in etc/uams/uams_pam.c.

References

github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/uams/uams_pam.c#L316

github.com/Netatalk/netatalk/issues/1096