CVE-2008-5718

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-12-26 · updated 2026-06-16
Weakness: CWE-78

Description

The papd daemon in Netatalk before 2.0.4-beta2, when using certain variables in a pipe command for the print file, allows remote attackers to execute arbitrary commands via shell metacharacters in a print request, as demonstrated using a crafted Title.

Affected products

Netatalk: through 2.0.3; 1.4.99-0.20000927, 1.4.99-0.20001108, 1.5-rc1, 1.5-rc2, 1.5.0, 1.5.1 (+25)

References

http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
http://osvdb.org/50824
http://secunia.com/advisories/33227
http://secunia.com/advisories/33548
http://secunia.com/advisories/34484
http://sourceforge.net/project/shownotes.php?release_id=648189
http://www.debian.org/security/2009/dsa-1705
http://www.openwall.com/lists/oss-security/2009/01/13/3
http://www.securityfocus.com/bid/32925
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00962.html
https://www.redhat.com/archives/fedora-package-announce/2009-March/msg00966.html
http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html

Get alerted when CVE-2008-5718 or the next vulnerability affects your stack