Buffer overflow in the Network Block Device (nbd) server 2.7.5 and earlier, and 2.8.0 through 2.8.2, allows remote attackers to execute arbitrary code via a large request, which is written past the end of the buffer because nbd does not account for memory taken by the reply header.

- Update to 2.9.20: fix CVE-2005-3534, BZ#673562

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Kurt Fitzner discovered a buffer overflow in nbd, the network block device client and server that could potentially allow arbitrary code on the NBD server.

Kurt Fitzner reports a buffer overflow vulnerability within nbd. This could potentially allow the execution of arbitrary code on the nbd server.

The remote host is affected by the vulnerability described in GLSA-200512-14 (NBD Tools: Buffer overflow in NBD server)

    Kurt Fitzner discovered that the NBD server allocates a request     buffer that fails to take into account the size of the reply header.
  Impact :

    A remote attacker could send a malicious request that can result     in the execution of arbitrary code with the rights of the NBD server.
  Workaround :

    There is no known workaround at this time.

The version of the Network Block Device (NBD) server installed on the remote host does not properly check the size of read requests before filling a dynamically-allocated buffer.  Using a specially crafted read request, an attacker can overwrite this buffer, which could crash the affected server or allow for the execution of arbitrary code.

ID	Name	Product	Family	Severity
51990	Fedora 14 : nbd-2.9.20-1.fc14 (2011-1108)	Nessus	Fedora Local Security Checks	high
51989	Fedora 13 : nbd-2.9.20-1.fc13 (2011-1097)	Nessus	Fedora Local Security Checks	high
22790	Debian DSA-924-1 : nbd - buffer overflow	Nessus	Debian Local Security Checks	high
21420	FreeBSD : nbd-server -- buffer overflow vulnerability (43770b1c-72f6-11da-8c1d-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
20355	GLSA-200512-14 : NBD Tools: Buffer overflow in NBD server	Nessus	Gentoo Local Security Checks	high
20341	Network Block Device (NBD) Server Request Handling Remote Overflow	Nessus	Denial of Service	high

Detections

Analytics

CVE-2005-3534

critical

Tenable Plugins

high

high

high

high

high

high