Netatalk Out-of-Bounds Access Vulnerability in ASP Session ID Handling

A vulnerability allowing out-of-bounds access has been identified in Netatalk versions 1.3 through 4.4.2. This issue arises from legacy ASP/DDP session management, where an attacker-controlled session identifier is used as an array index without proper validation against the session table size. As a result, an unauthenticated network attacker could potentially crash the service. While reliable code execution is less certain, the possibility exists.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the service to crash. Additionally, there is a potential, albeit uncertain, risk of arbitrary code execution.

Remediation

Users can upgrade to Netatalk version 4.4.3 or later, which includes the necessary patch. Alternatively, the patch can be applied to a Netatalk 4.4.2 source tree. Netatalk administrators are advised to take action as soon as possible.