Netatalk Stack Buffer Overflow Vulnerability in Desktop Metadata Processing

A stack buffer overflow vulnerability has been identified in Netatalk versions 1.3 through 4.2.2. The issue arises in the 'desktop.c' file, where the application improperly handles long directory entry names, allowing them to overflow a small stack buffer. This vulnerability could lead to a denial-of-service condition. The practical impact may vary depending on whether an authenticated user can manipulate the affected metadata to trigger ownership or mode updates.

Impact

Exploitation of this vulnerability causes a stack buffer overflow, which can lead to arbitrary code execution or a denial-of-service condition, depending on the context of the overflow.

Remediation

Users can upgrade to Netatalk version 4.5.0 or later, which includes the necessary patch. Alternatively, the patch can be applied to a Netatalk 4.4.2 source tree to hotfix the vulnerability.