CVE-2011-0530 Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request. NOTE: this...
HighCVSS 7.5
EPSS 5.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request. NOTE: this issue exists because of a CVE-2005-3534 regression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wouter verhelst nbd | <= 2.9.19 | No fix listed |
| wouter verhelst nbd | = 2.9.0 | No fix listed |
| wouter verhelst nbd | = 2.9.1 | No fix listed |
| wouter verhelst nbd | = 2.9.2 | No fix listed |
| wouter verhelst nbd | = 2.9.3 | No fix listed |
| wouter verhelst nbd | = 2.9.4 | No fix listed |
| wouter verhelst nbd | = 2.9.5 | No fix listed |
| wouter verhelst nbd | = 2.9.6 | No fix listed |
| wouter verhelst nbd | = 2.9.7 | No fix listed |
| wouter verhelst nbd | = 2.9.8 | No fix listed |
| wouter verhelst nbd | = 2.9.9 | No fix listed |
| wouter verhelst nbd | = 2.9.10 | No fix listed |
| wouter verhelst nbd | = 2.9.11 | No fix listed |
| wouter verhelst nbd | = 2.9.12 | No fix listed |
| wouter verhelst nbd | = 2.9.13 | No fix listed |
| wouter verhelst nbd | = 2.9.14 | No fix listed |
| wouter verhelst nbd | = 2.9.15 | No fix listed |
| wouter verhelst nbd | = 2.9.16 | No fix listed |
| wouter verhelst nbd | = 2.9.17 | No fix listed |
| wouter verhelst nbd | = 2.9.18 | No fix listed |
| debian/nbd(Debian:12) | < 1:2.9.16-8 | 1:2.9.16-8 |
| debian/nbd(Debian:13) | < 1:2.9.16-8 | 1:2.9.16-8 |
| debian/nbd(Debian:14) | < 1:2.9.16-8 | 1:2.9.16-8 |
References
- bugs.debian.org
- FEDORA-2011-1097 patch vendor-advisory
- FEDORA-2011-1108 patch vendor-advisory
- SUSE-SR:2011:005 vendor-advisory
- [oss-security] 20110128 CVE Request -- NDB: CVE-2005-3534 reintroduced in upstream nbd-v2.9.0 version mailing-list patch
- [oss-security] 20110131 Re: CVE Request -- NDB: CVE-2005-3534 reintroduced in upstream nbd-v2.9.0 version mailing-list patch
- 43353 third-party-advisory vendor-advisory
- 43610 third-party-advisory
- GLSA-201206-35 vendor-advisory
- DSA-2183 vendor-advisory
- 46572 vdb-entry
- ADV-2011-0403 vdb-entry vendor-advisory
- ADV-2011-0582 vdb-entry
- bugzilla.redhat.com patch
- networkblock-nbdserver-bo(65720) vdb-entry
- github.com patch
- openSUSE-SU-2011:0193 vendor-advisory
- Debian Security Tracker CVE-2011-0530 vendor-advisory
- bugs.debian.org issue-tracking