Published: 29/05/2015 Updated: 31/12/2016

CVSS v2 Base Score: 7.8 | Impact Score: 6.9 | Exploitability Score: 10

VMScore: 694

Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C

The modern style negotiation in Network Block Device (nbd-server) 2.9.22 up to and including 3.3 allows remote malicious users to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.

Vulnerable Product	Search on Vulmon	Subscribe to Product
wouter verhelst nbd 2.9.3
wouter verhelst nbd 2.9.4
wouter verhelst nbd 3.1
wouter verhelst nbd 3.1.1
wouter verhelst nbd 3.2
wouter verhelst nbd 2.9.22
wouter verhelst nbd 2.9.23
wouter verhelst nbd 2.9.7
wouter verhelst nbd 2.9.8
wouter verhelst nbd 2.9.24
wouter verhelst nbd 2.9.25
wouter verhelst nbd 2.9.9
wouter verhelst nbd 3.0
wouter verhelst nbd 2.9.5
wouter verhelst nbd 2.9.6
wouter verhelst nbd 3.3

Several security issues were fixed in NBD ...

Debian Bug report logs - #784657 nbd: CVE-2015-0847: unsafe signal handling Package: src:nbd; Maintainer for src:nbd is Wouter Verhelst <wouter@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 7 May 2015 14:27:02 UTC Severity: important Tags: patch, security, upstream Found in versions ...

Debian Bug report logs - #781547 nbd: CVE-2013-7441: server dies if client asks for a non-existing export Package: nbd-server; Maintainer for nbd-server is Wouter Verhelst <wouter@debianorg>; Source for nbd-server is src:nbd (PTS, buildd, popcon) Reported by: Tuomas Räsänen <tuomasjjrasanen@tjjrfi> Date: Mon, 30 ...

Tuomas Räsänen discovered that unsafe signal handling in nbd-server, the server for the Network Block Device protocol, could allow remote attackers to cause a deadlock in the server process and thus a denial of service Tuomas Räsänen also discovered that the modern-style negotiation was carried out in the main server process before forking the ...

CWE-399 http://www.openwall.com/lists/oss-security/2015/05/21/5 http://www.openwall.com/lists/oss-security/2015/05/19/6 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781547 https://github.com/yoe/nbd/commit/741495cb08503fd32a9d22648e63b64390c601f4 http://sourceforge.net/p/nbd/mailman/message/30410146/http://www.debian.org/security/2015/dsa-3271 http://www.ubuntu.com/usn/USN-2676-1 http://www.securityfocus.com/bid/74808 http://lists.opensuse.org/opensuse-updates/2015-06/msg00003.html https://usn.ubuntu.com/2676-1/https://nvd.nist.gov

CVE-2013-7441

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect