**Synopsis**
Tenable discovered an out-of-bounds write in Netatalk's dsi_opensession() function in `dsi_opensess.c`. The vulnerable code follows:
```
memcpy(&dsi->attn_quantum, dsi->commands + i + 1, dsi->commands[i]);
```
The attn_quantum variable is a 32 bit integer and dsi->commands is attacker controlled. A remote unauthenticated attacker can leverage this to write 251 bytes beyond the attn_quantum in the dsi struct and control code execution.
暂无评论