9.8

CVE-2024-38441

Exploit
Netatalk before 3.2.1 has an off-by-one error and resultant heap-based buffer overflow because of setting ibuf[len] to '\0' in FPMapName in afp_mapname in etc/afpd/directory.c. 2.4.1 and 3.1.19 are also fixed versions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Netatalk ≫ Netatalk Version >= 2.0.0 < 2.4.1
Netatalk ≫ Netatalk Version >= 3.0 < 3.1.19
Netatalk ≫ Netatalk Version 3.2.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.92% 0.556
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-193 Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

https://github.com/Netatalk/netatalk/blob/90d91a9ac9a7d6132ab7620d31c8c23400949206/etc/afpd/directory.c#L2333
Product
https://github.com/Netatalk/netatalk/issues/1098
Not Applicable
https://github.com/Netatalk/netatalk/security/advisories/GHSA-mj6v-cr68-mj9q
Vendor Advisory
Exploit
https://netatalk.io/security/CVE-2024-38441
Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/11/msg00026.html