CVE-2018-1160
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to...
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
- Record
CVE-2018-1160- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787, CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2018-11798
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
- Record
EUVD-2018-11798- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-j675-7hvj-qfw5
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to...
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
- Record
GHSA-j675-7hvj-qfw5- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
- Record
CVE-2018-1160- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
- Record
CVE-2018-1160- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1160
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
- Record
DEBIAN-CVE-2018-1160- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2018-1160
Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution.
- Record
UBUNTU-CVE-2018-1160- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0061 No score
Updated netatalk packages fix security vulnerability
Jacob Baines discovered a flaw in the handling of the DSI Opensession command in Netatalk, allowing an unauthenticated user to execute arbitrary code with root privileges (CVE-2018-1160).
- Record
MGASA-2019-0061- Updated
- 2026-11-02
OSVSUSE-SU-2018:4214-1 No score
Security update for netatalk
This update for netatalk fixes the following issues:
Security issue fixed:
- CVE-2018-1160 Fixed a missing bounds check in the handling of the DSI OPEN SESSION request, which allowed an unauthenticated to overwrite memory with data of their choice leading for arbitrary code execution with root privileges. (bsc#1119540)
- Record
SUSE-SU-2018:4214-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:4217-1 No score
Security update for netatalk
This update for netatalk fixes the following issues:
Security issue fixed:
- CVE-2018-1160 Fixed a missing bounds check in the handling of the DSI OPEN SESSION request, which allowed an unauthenticated to overwrite memory with data of their choice leading to arbitrary code execution with root privileges. (bsc#1119540)
- Record
SUSE-SU-2018:4217-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
netatalkDebian:13 |
before 2.2.6-2 | 2.2.6-2 |
netatalkDebian:14 |
before 2.2.6-2 | 2.2.6-2 |
netatalkDebian:9 |
before 2.2.5-2+deb9u1, plus listed versions 2.2.5-2 |
2.2.5-2+deb9u1 |
netatalkMageia:6 |
before 3.1.12-1.1.mga6 | 3.1.12-1.1.mga6 |
netatalkSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.0.3-249.23.3.1 | 2.0.3-249.23.3.1 |
netatalkSUSE:Linux Enterprise Desktop 12 SP3 |
before 3.1.0-3.3.1 | 3.1.0-3.3.1 |
netatalkSUSE:Linux Enterprise Desktop 12 SP4 |
before 3.1.0-3.3.1 | 3.1.0-3.3.1 |
netatalkSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 3.1.0-3.3.1 | 3.1.0-3.3.1 |
netatalkSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 3.1.0-3.3.1 | 3.1.0-3.3.1 |
netatalkSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 3.1.0-3.3.1 | 3.1.0-3.3.1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
netatalkSUSE:Linux Enterprise Workstation Extension 12 SP4 |
before 3.1.0-3.3.1 | 3.1.0-3.3.1 |
netatalkUbuntu:14.04:LTS |
before 2.2.2-1ubuntu2.2, plus listed versions 2.2.2-1ubuntu12.2.2-1ubuntu2 |
2.2.2-1ubuntu2.2 |
netatalkUbuntu:16.04:LTS |
before 2.2.5-1ubuntu0.2, plus listed versions 2.2.5-1 |
2.2.5-1ubuntu0.2 |
netatalkUbuntu:18.04:LTS |
before 2.2.6-1ubuntu0.18.04.2, plus listed versions 2.2.6-1 |
2.2.6-1ubuntu0.18.04.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Netatalk 3.1.12 - Authentication Bypass | 2018-12-21 |
| Exploit-DB | Netatalk 3.1.12 - Authentication Bypass (PoC) | 2018-12-21 |
| Exploit-DB | QNAP Netatalk < 3.1.12 - Authentication Bypass | 2019-04-08 |
| PoC in GitHub | SachinThanushka/CVE-2018-1160 | 2020-05-12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, Exploit-DB, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1160 is a critical vulnerability (CVSS 9.8) in Netatalk, published December 20, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 86.4%, the 99th percentile. Fixed in netatalk 2.2.6-2.
References
netatalk.sourceforge.net/3.1/ReleaseNotes3.1.12.html
attachments.samba.org/attachment.cgi?id=14735
securityfocus.com/bid/106301
exploit-db.com/exploits/46034
github.com/tenable/poc/tree/master/netatalk/cve_2018_1160
Show 17 moreShow less
synology.com/security/advisory/Synology_SA_18_62
tenable.com/security/research/tra-2018-48
debian.org/security/2018/dsa-4356
packetstormsecurity.com/files/152440/QNAP-Netatalk-Authentication-Bypass.html
nvd.nist.gov/vuln/detail/CVE-2018-1160
security-tracker.debian.org/tracker/CVE-2018-1160
advisories.mageia.org/MGASA-2019-0061.html
bugs.mageia.org/show_bug.cgi?id=24072
suse.com/support/update/announcement/2018/suse-su-20184214-1
bugzilla.suse.com/1119540
ubuntu.com/security/CVE-2018-1160
bugzilla.samba.org/show_bug.cgi?id=13711
cve.org/CVERecord?id=CVE-2018-1160