netatalk: Unauthenticated remote code execution (CVE-2018-1160)
Netatalk before 3.1.12 is vulnerable to an out of bounds write in
dsi_opensess.c. This is due to lack of bounds checking on attacker
controlled data.
A remote unauthenticated attacker can leverage this vulnerability to
achieve arbitrary code execution.
References:
http://netatalk.sourceforge.net/3.1/ReleaseNotes3.1.12.html
https://nvd.nist.gov/vuln/detail/CVE-2018-1160
Patch:
https://github.com/Netatalk/Netatalk/commit/750f9b55844b444b8ff1a38206fd2bdbab85c21f
(from redmine: issue id 9781, created on 2018-12-24, closed on 2019-02-19)
- Relations:
- child #9782 (closed)
- child #9783 (closed)
- Changesets:
- Revision 5651f47d by Roberto Oliveira on 2019-01-08T10:16:06Z:
community/netatalk: security upgrade to 3.1.12 CVE-2018-1160)
Fixes #9781