GitLab

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data.
A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.

References:

http://netatalk.sourceforge.net/3.1/ReleaseNotes3.1.12.html
https://nvd.nist.gov/vuln/detail/CVE-2018-1160

Patch:

https://github.com/Netatalk/Netatalk/commit/750f9b55844b444b8ff1a38206fd2bdbab85c21f

(from redmine: issue id 9782, created on 2018-12-24, closed on 2019-02-19)

• Relations:
  • parent #9781 (closed)