What this actually is.
Technical background, root cause, and affected surface.
An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- High
- CVSS Score
- 7.1
- Status
- Published
- CWE
- CWE-125: Out-of-bounds Read
- Vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
libatalk/asp/asp_open.c or afpd/asp.c: session ID used as array index without bounds validation
Root cause: Missing bounds check on ASP session ID before use as array index
When does this fire?
All conditions must be true for the exploit to succeed.
Adjacent network attacker sends an ASP request with an out-of-range session ID value
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Process memory disclosure or daemon crash (DoS)
C:L · I:N · A:H
CWE-125: Out-of-bounds Read
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds session ID bounds validation before array access.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.