[Hat-Squad Advisory] Bakbone NetVault Heap overflow Vulnerabilities
Hat-Squad Advisory: BakBone NetVault Remote Heap and Local Buffer
Overflow
April 1, 2005
Product: BakBone NetVault
Vendor URL: http://www.bakbone.com
Version: NetVault 7.x, 6.x
Vulnerability: Remote and Local Heap Buffer overflows
Release Date:1 April 2005
Vendor Status:
17-3-2005: vendor notified #1/3
18-3-2005: vendor notified #2/3
19-3-2005: vendor notified #3/3
21-3-2005: vendor RE-notification #1/1
24-3-2005: vendor wake up
Response: I'm on a business trip!
Description:
NetVault is a professional backup and restore solution for eterogeneous
UNIX, Windows NT/2000, Linux and Netware enterprise environments.With
NetVault you can rapidly add and configure new servers, devices and
clients, and control them from a central location.
Details:a
Problem details could be found at:
http://www.class101.org/netv-remhbof.pdf (remote overflow)
http://www.class101.org/netv-locsbof.pdf (local overflow)
For proof of concepts (both remote and local) please visit:
http://class101.org/36/55/op.php
http://www.hat-squad.com
Solution:
At the moment of writing this advisory, no patch is released, we can
only suggest to :
1- Restrict all incoming connections to 20031/tcp and 20031/udp, a fix
might come very soon.
2- set STRICTS ACL rules, for example, allow ONLY SYSTEM to write in
configure.cfg. This will protect against Local attack.
Credits:
This Vulnerability has been Discoverd By class101 (class101@hat-
squad.com)
Disclaimer:
This Advisory is provided on an "AS IS" basis and does not imply any
kind of guarantee or warranty. Neither the author nor the publisher
accepts any liability for any direct, indirect,or consequential loss or
damage arising from use of, or reliance on, this informations.