Synology-SA-23:03 Netatalk

Publish Time: UTC+8

Last Updated: UTC+8

Severity
Not affected
Status
Resolved

Abstract

None of Synology's products are affected by CVE-2022-43634.

Affected Products

Product Severity Fixed Release Availability
DSM 7.1 Not affected N/A
DSM 7.0 Not affected N/A
DSM 6.2 Not affected N/A
SRM 1.3 Not affected N/A
SRM 1.2 Not affected N/A
VS Firmware 3.0 Not affected N/A

Mitigation

None

Detail

  • CVE-2022-43634
    • Severity: Not affected
    • CVSS3 Base Score: 0.0
    • CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
    • This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsi_writeinit function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17646.

Reference

CVE-2022-43634

Revision

Revision Date Description
1 2023-03-30 Initial public release.