ASP (AppleTalk Session Protocol) session ID handling in Netatalk does not validate the session ID index before array access. A crafted ASP request with an out-of-range session ID causes an out-of-bounds read, potentially leaking process memory or crashing the daemon.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
libatalk/asp/asp_open.c or afpd/asp.c: session ID used as array index without bounds validation
Root cause: Missing bounds check on ASP session ID before use as array index
All conditions must be true for the exploit to succeed.
Adjacent network attacker sends an ASP request with an out-of-range session ID value
Post-exploitation outcomes mapped to CVSS impact metrics.
Process memory disclosure or daemon crash (DoS)
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Upgrade to Netatalk 4.4.3 which adds session ID bounds validation before array access.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Timeline recorded · Disclosure coordinated by Securin
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
