CVE-2024-38441

2024-06-1613:15:53

Debian Security Bug Tracker

security-tracker.debian.org

netatalk 3.2.0

off-by-one error

heap-based buffer overflow

afp_mapname

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

Low

EPSS

Percentile

15.7%

JSON

Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to ‘\0’ in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions.

OSVersionArchitecturePackageVersionFilename
Debian11allnetatalk<= 3.1.12~ds-8+deb11u1netatalk_3.1.12~ds-8+deb11u1_all.deb
Debian999allnetatalk< 3.1.18~ds-2netatalk_3.1.18~ds-2_all.deb
Debian13allnetatalk< 3.1.18~ds-2netatalk_3.1.18~ds-2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	all	netatalk	<= 3.1.12~ds-8+deb11u1	netatalk_3.1.12~ds-8+deb11u1_all.deb
Debian	999	all	netatalk	< 3.1.18~ds-2	netatalk_3.1.18~ds-2_all.deb
Debian	13	all	netatalk	< 3.1.18~ds-2	netatalk_3.1.18~ds-2_all.deb