AS-2022-006: Netatalk

2022-05-06

Statement

The Netatalk development team disclosed multiple fixed vulnerabilities affecting earlier versions of the software on the latest release of Netatalk 3.1.13: CVE-2021-31439, CVE-2022-23121, CVE-2022-23122, CVE-2022-23123, CVE-2022-23124, CVE-2022-23125 and CVE-2022-0194.

Netatalk 3.1.13 has been updated on ADM 4.0.5.RT42 and ADM 3.5.9.RT42 to resolve these issues.

Affected Products

Mitigation

Netatalk provides file access through AFP (Apple Filing Protocol) on ADM. AFP service has been disabled by default since ADM 4.0. We recommend using SMB protocol instead when connecting from macOS.

For ASUSTOR NAS not yet upgraded to ADM 3.5.9.RT42 or above, administrators can disable AFP service to mitigate the specific vulnerabilities. In environments where AFP is still needed, setting up firewall rules to only allow trusted clients to connect over AFP (port 548) can be used as temporary mitigation.

Detail

• CVE-2021-31439
  • Severity: Important
  • This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12326.
• CVE-2022-23121, CVE-2022-23122, CVE-2022-23123, CVE-2022-23124, CVE-2022-23125, CVE-2022-0194
  • Severity: Important
  • ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Reference

• Netatalk 3.1.13 release notes
• CVE-2021-31439
• CVE-2022-0194
• CVE-2022-23121
• CVE-2022-23122
• CVE-2022-23123
• CVE-2022-23124
• CVE-2022-23125

Revision