PT-2015-3589 · Nbd+2 · Nbd-Server+2

Tuomas Räsänen · Published 2015-05-23 · Updated 2024-11-15 · CVE-2013-7441

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions nbd-server versions 2.9.22 through 3.3

Description The issue in nbd-server allows remote attackers to cause a denial of service by either closing the connection during negotiation or specifying a name for a non-existent export, which can lead to the termination of the root process.

Recommendations For versions 2.9.22 through 3.3, consider implementing measures to handle connection closures and invalid export names to prevent denial of service attacks. As a temporary workaround, restrict access to the nbd-server to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2020-3164

ALT-PU-2020-3187

ALT-PU-2024-15569

CVE-2013-7441

DSA-3271-1

USN-2676-1

Affected Products

Alt Linux

Ubuntu

Nbd-Server

References · 21

• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7441 · Vendor Advisory
• http://debian.org/security/2015/dsa-3271 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3271-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7441 · Security Note
• https://ubuntu.com/security/notices/USN-2676-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2676-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7441 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7441 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-7441 · Security Note
• https://ubuntu.com/security/CVE-2013-7441 · Vendor Advisory
• http://ubuntu.com/usn/USN-2676-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-7441 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-06/msg00003.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-0847 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-6410 · Vendor Advisory