CVE-2023-42464

A Type Confusion vulnerability was found in the Spotlight RPC functions in
afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets,
one encoded data structure is a key-value style dictionary where the keys
are character strings, and the values can be any of the supported types in
the underlying protocol. Due to a lack of type checking in callers of the
dalloc_value_for_key() function, which returns the object associated with a
key, a malicious actor may be able to fully control the value of the
pointer and theoretically achieve Remote Code Execution on the host. This
issue is similar to CVE-2023-34967.

Bugs

• <https://github.com/Netatalk/netatalk/pull/485&gt;
• <https://github.com/Netatalk/netatalk/issues/486&gt;

Notes