QSAN Responds to CVE-2022-43634 - Netatalk

Abstract

None of QSANs’ products are affected by CVE-2022-43634.

Applied to

Mitigation

None.

Detail

• CVE-2022-43634

  • Severity: Not affected

  • CVSS3 Base Score: 0.0

  • CVSS3 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

  • This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the dsi_writeinit function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17646.

Reference

CVE-2022-43634