Heap-based Buffer Overflow Vulnerability in Netatalk 3.2.0

CVE-2024-38441

What is CVE-2024-38441?

Netatalk prior to version 3.2.1 contains a notable vulnerability due to an off-by-one error that leads to a heap-based buffer overflow. This issue arises from the improper handling of the input buffer when the function FPMapName is called within afp_mapname, specifically in the file directory.c. The software fails to properly terminate the buffer, allowing for the possibility of memory corruption, which could be exploited by attackers to execute arbitrary code or cause a denial of service.

References