What this actually is.
Technical background, root cause, and affected surface.
Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions.
- Vendor
- Netatalk
- Product
- Netatalk
- Severity
- Medium
- CVSS Score
- 5
- Status
- Published
- CWE
- CWE-273: Improper Check for Dropped Privileges
- Vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
The bug, and the fix.
etc/uams/uams_*.c: seteuid(getuid()) calls without return value validation
Root cause: seteuid() return value not checked in authentication module privilege transitions
When does this fire?
All conditions must be true for the exploit to succeed.
Specific OS conditions cause seteuid() to fail (EAGAIN from resource limits); local attacker may be able to trigger this condition
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
afpd process retains elevated effective UID when privilege drop silently fails
C:L · I:L · A:L
CWE-273: Improper Check for Dropped Privileges
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which checks seteuid() return values and aborts authentication on failure.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Vendor notified
Netatalk 4.4.3 patch released
CVE published to MITRE
Disclosed 60 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.