CVE-2018-1160

critical-risk
Published 2018-12-20

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.

Do I need to act?

!
89.7% chance of exploitation in next 30 days
EPSS score — higher than 10% of all CVEs
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
3 public exploits available
46048, 46034, 46675
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.8/10 Critical
NETWORK / LOW complexity

Affected Products (6)

Affected Vendors

Debian Netatalk Synology

References (22)

Release Notes http://netatalk.sourceforge.net/3.1/ReleaseNotes3.1.12.html
Exploit http://packetstormsecurity.com/files/152440/QNAP-Netatalk-Authentication-Bypass....
Third Party Advisory http://www.securityfocus.com/bid/106301
Third Party Advisory https://attachments.samba.org/attachment.cgi?id=14735
Release Notes https://github.com/tenable/poc/tree/master/netatalk/cve_2018_1160/
Third Party Advisory https://www.debian.org/security/2018/dsa-4356
Exploit https://www.exploit-db.com/exploits/46034/
Exploit https://www.exploit-db.com/exploits/46048/
Exploit https://www.exploit-db.com/exploits/46675/
Third Party Advisory https://www.synology.com/security/advisory/Synology_SA_18_62
Exploit https://www.tenable.com/security/research/tra-2018-48
Release Notes http://netatalk.sourceforge.net/3.1/ReleaseNotes3.1.12.html
Exploit http://packetstormsecurity.com/files/152440/QNAP-Netatalk-Authentication-Bypass....
Third Party Advisory http://www.securityfocus.com/bid/106301
Third Party Advisory https://attachments.samba.org/attachment.cgi?id=14735
Release Notes https://github.com/tenable/poc/tree/master/netatalk/cve_2018_1160/
Third Party Advisory https://www.debian.org/security/2018/dsa-4356
Exploit https://www.exploit-db.com/exploits/46034/
Exploit https://www.exploit-db.com/exploits/46048/
Exploit https://www.exploit-db.com/exploits/46675/
and 2 more references
72
/ 100
critical-risk
Severity 32/34 · Critical
Exploitability 27/34 · High
Exposure 13/34 · Low