CVE-2008-5718 The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a p...
HighCVSS 9.3
EPSS 4.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| netatalk | <= 2.0.3 | No fix listed |
| netatalk | = 1.4.99-0.20000927 | No fix listed |
| netatalk | = 1.4.99-0.20001108 | No fix listed |
| netatalk | = 1.5-rc1 | No fix listed |
| netatalk | = 1.5-rc2 | No fix listed |
| netatalk | = 1.5.0 | No fix listed |
| netatalk | = 1.5.1 | No fix listed |
| netatalk | = 1.5.1.1 | No fix listed |
| netatalk | = 1.5.2 | No fix listed |
| netatalk | = 1.5.3.1 | No fix listed |
| netatalk | = 1.5.5 | No fix listed |
| netatalk | = 1.5pre3 | No fix listed |
| netatalk | = 1.5pre4 | No fix listed |
| netatalk | = 1.5pre5 | No fix listed |
| netatalk | = 1.5pre6 | No fix listed |
| netatalk | = 1.5pre7 | No fix listed |
| netatalk | = 1.5pre8 | No fix listed |
| netatalk | = 1.6.0 | No fix listed |
| netatalk | = 1.6.1 | No fix listed |
| netatalk | = 1.6.2 | No fix listed |
| netatalk | = 1.6.3 | No fix listed |
| netatalk | = 1.6.4 | No fix listed |
| netatalk | = 1.6.4a | No fix listed |
| netatalk | = 2.0-alpha1 | No fix listed |
| netatalk | = 2.0-alpha2 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| netatalk | = 2.0-beta1 | No fix listed |
| netatalk | = 2.0-beta2 | No fix listed |
| netatalk | = 2.0-rc1 | No fix listed |
| netatalk | = 2.0-rc2 | No fix listed |
| netatalk | = 2.0.0 | No fix listed |
| netatalk | = 2.0.1 | No fix listed |
| netatalk | = 2.0.2 | No fix listed |
| debian/netatalk(Debian:13) | < 2.0.4~beta2-1 | 2.0.4~beta2-1 |
| debian/netatalk(Debian:14) | < 2.0.4~beta2-1 | 2.0.4~beta2-1 |
References
- SUSE-SR:2009:004 vendor-advisory
- 50824 vdb-entry
- 33227 third-party-advisory vendor-advisory
- 33548 third-party-advisory vendor-advisory
- 34484 third-party-advisory vendor-advisory
- sourceforge.net
- DSA-1705 patch vendor-advisory
- [oss-security] 20090114 update on CVE-2008-5718 mailing-list
- 32925 patch vdb-entry
- FEDORA-2009-3064 vendor-advisory
- FEDORA-2009-3069 vendor-advisory
- Debian Security Tracker CVE-2008-5718 vendor-advisory
- bugs.debian.org issue-tracking