Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.

NIST reports :

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.

This update for netatalk fixes the following issues :

Security issue fixed :

  - CVE-2018-1160 Fixed a missing bounds check in the     handling of the DSI OPEN SESSION request, which allowed     an unauthenticated to overwrite memory with data of     their choice leading for arbitrary code execution with     root privileges. (bsc#1119540)

This update for netatalk fixes the following issues :

Security issue fixed :

CVE-2018-1160 Fixed a missing bounds check in the handling of the DSI OPEN SESSION request, which allowed an unauthenticated to overwrite memory with data of their choice leading to arbitrary code execution with root privileges. (bsc#1119540)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New netatalk packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix a security issue.

Jacob Baines discovered a flaw in the handling of the DSI Opensession command in Netatalk, an implementation of the AppleTalk Protocol Suite, allowing an unauthenticated user to execute arbitrary code with root privileges.

The Apple Filing Protocol (AFP) server running on the remote host is affected by a remote code execution vulnerability due to a buffer overflow condition when handling an OpenSession request. An unauthenticated, remote attacker can exploit this issue, via a specially crafted message, to execute arbitrary code.

ID	Name	Product	Family	Severity
125935	FreeBSD : netatalk3 -- remote code execution vulnerability (9c9023ff-9057-11e9-b764-00505632d232)	Nessus	FreeBSD Local Security Checks	critical
119946	openSUSE Security Update : netatalk (openSUSE-2018-1614)	Nessus	SuSE Local Security Checks	critical
119870	SUSE SLED12 Security Update : netatalk (SUSE-SU-2018:4217-1)	Nessus	SuSE Local Security Checks	critical
119853	Slackware 14.0 / 14.1 / 14.2 / current : netatalk (SSA:2018-355-01)	Nessus	Slackware Local Security Checks	critical
119817	Debian DSA-4356-1 : netatalk - security update	Nessus	Debian Local Security Checks	critical
119780	Netatalk OpenSession Remote Code Execution	Nessus	Gain a shell remotely	critical

Detections

Analytics

CVE-2018-1160

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical