Netatalk up to 3.1.16 afpd dalloc_value_for_key type confusion

Summaryinfo

A vulnerability labeled as critical has been found in Netatalk up to 3.1.16. This impacts the function dalloc_value_for_key of the component afpd. Executing a manipulation can lead to type confusion. This vulnerability is registered as CVE-2023-42464. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Netatalk up to 3.1.16. This vulnerability affects the function dalloc_value_for_key of the component afpd. The manipulation with an unknown input leads to a type confusion vulnerability. The CWE definition for the vulnerability is CWE-843. The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When parsing Spotlight RPC packets, one encoded data structure is a key-value style dictionary where the keys are character strings, and the values can be any of the supported types in the underlying protocol. Due to a lack of type checking in callers of the dalloc_value_for_key() function, which returns the object associated with a key, a malicious actor may be able to fully control the value of the pointer and theoretically achieve Remote Code Execution on the host. This issue is similar to CVE-2023-34967.

The weakness was published 09/20/2023 as 486. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-42464 since 09/11/2023. There are known technical details, but no exploit is available.

Upgrading to version 3.1.17 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• Netatalk

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.1.8
• 3.1.9
• 3.1.10
• 3.1.11
• 3.1.12
• 3.1.13
• 3.1.14
• 3.1.15
• 3.1.16

Website

• Product: https://github.com/Netatalk/netatalk/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion