Executive brief
Netatalk, a file server suite that allows Linux and Unix systems to serve files to Apple computers, contains a bug in how it handles certain file names. When processing file names containing uppercase hexadecimal characters, the system may incorrectly decode the name, leading to file name corruption or inconsistencies when looking up files. This issue is considered low risk as it does not lead to data theft or unauthorized access, but it can cause operational issues with file management.
Technical details
A vulnerability exists in the hextoint macro within Netatalk versions 2.0.0 through 4.4.2 due to an 'uppercase bug' (CWE-682). The macro fails to correctly compute values for uppercase hexadecimal characters during filename conversion. An authenticated attacker with network access could potentially trigger this by using specific hexadecimal escapes in filenames, leading to filename corruption or lookup inconsistencies. The attack complexity is high and the impact is limited to data integrity (incorrect file naming/mapping) without providing a path to code execution or privilege escalation. The issue is resolved in version 4.5.0.
Affected products
- Netatalk Netatalk 2.0.0 through 4.4.2
Timeline
- 2026-05-13: disclosed: Initial disclosure date
- 2026-05-21: advisory: NVD and vendor advisory published