What this actually is.
Technical background, root cause, and affected surface.
A heap over-read in extended attribute (EA) header parsing in Netatalk 2.1.0 through 4.4.2 allows a remote authenticated attacker to obtain limited information or cause a minor service disruption via crafted EA data.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Medium
- CVSS Score
- 4.2
- Status
- Published
- CWE
- CWE-125: Out-of-bounds Read
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
afpd/ea.c: EA header parsing reads length-delimited fields without validating the length against remaining buffer size
Root cause: Missing bounds check on EA header field lengths before reading from the header buffer
When does this fire?
All conditions must be true for the exploit to succeed.
Attacker sends an AFP request with a crafted Extended Attributes header containing manipulated length fields
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
Heap memory disclosure; potentially exposing pointers, tokens, or sensitive data adjacent to the EA buffer
C:L · I:N · A:L
CWE-125: Out-of-bounds Read
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which validates EA header field lengths against buffer boundaries before reading.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.