The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title.

This update of netatalk adds a filter for characters of user-supplied data to papd. Prior to this update it was possible to execute arbitrary shell commands remotely. (CVE-2008-5718)

The bug fixes backporting from upstream.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Secunia reports :

A vulnerability has been reported in Netatalk, which potentially can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to the papd daemon improperly sanitising several received parameters before passing them in a call to popen(). This can be exploited to execute arbitrary commands via a specially crafted printing request.

Successful exploitation requires that a printer is configured to pass arbitrary values as parameters to a piped command.

It was discovered that netatalk, an implementation of the AppleTalk suite, is affected by a command injection vulnerability when processing PostScript streams via papd. This could lead to the execution of arbitrary code. Please note that this only affects installations that are configured to use a pipe command in combination with wildcard symbols substituted with values of the printed job.

ID	Name	Product	Family	Severity
41563	SuSE 10 Security Update : netatalk (ZYPP Patch Number 5983)	Nessus	SuSE Local Security Checks	high
40282	openSUSE Security Update : netatalk (netatalk-510)	Nessus	SuSE Local Security Checks	high
40079	openSUSE Security Update : netatalk (netatalk-510)	Nessus	SuSE Local Security Checks	high
37242	Fedora 10 : netatalk-2.0.3-23.fc10 (2009-3069)	Nessus	Fedora Local Security Checks	high
36026	Fedora 9 : netatalk-2.0.3-21.fc9 (2009-3064)	Nessus	Fedora Local Security Checks	high
35963	FreeBSD : netatalk -- arbitrary command execution in papd daemon (72cba7b0-13cd-11de-a964-0030843d3802)	Nessus	FreeBSD Local Security Checks	high
35646	openSUSE 10 Security Update : netatalk (netatalk-5989)	Nessus	SuSE Local Security Checks	high
35382	Debian DSA-1705-1 : netatalk - missing input sanitising	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2008-5718

critical

Tenable Plugins

high

high

high

high

high

high

high

high