nbd - Security Update
Summary
DSA-3271-1: nbd - security update. Affects nbd versions < 1:3.2-4~deb7u5. Fixed in 1:3.2-4~deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nbd package is the server for the Network Block Device (NBD) protocol. It allows remote clients to access block devices over a network. The package is commonly used in virtualization environments to provide network-based storage to virtual machines. The vulnerability in nbd-server could lead to a deadlock in the server process, resulting in a denial of service. Additionally, the modern-style negotiation in the main server process before forking the client handler could cause a crash when querying a non-existent export. This vulnerability only affects the oldstable distribution (wheezy).
Vulnerability Detail
The unsafe signal handling in nbd-server allows remote attackers to cause a deadlock in the server process, leading to a denial of service. The modern-style negotiation carried out in the main server process before forking the client handler allows a remote attacker to crash the server by querying a non-existent export. These vulnerabilities have been assigned CVE-2013-7441 and CVE-2015-0847 respectively. The impact of these vulnerabilities includes service disruption and potential unauthorized access to the server.
How To Fix
Minimum fixed version
1:3.2-4~deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nbdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The nbd package is vulnerable to two security issues that could result in a denial of service and potential unauthorized access. It is crucial to upgrade the package to the fixed versions mentioned above to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for nbd →
FAQ
The Network Block Device (NBD) protocol allows remote clients to access block devices over a network. It is commonly used in virtualization environments to provide network-based storage to virtual machines.
The vulnerabilities in nbd-server can lead to a denial of service, causing service disruption. Additionally, unauthorized access to the server may be possible.
The vulnerabilities only affect the oldstable distribution (wheezy) of nbd.
No, there are no known workarounds for these vulnerabilities. It is recommended to upgrade the nbd package to the fixed versions.
To upgrade the nbd package, follow the standard package upgrade procedure for your distribution. Refer to the official documentation or community resources for detailed instructions.
Related vulnerabilities
Recent vulnerabilities recorded for nbd.
