Debian Security Advisory
DSA-3271-1 nbd -- security update
- Date Reported:
- 23 May 2015
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 781547, Bug 784657.
In Mitre's CVE dictionary: CVE-2013-7441, CVE-2015-0847.
- More information:
Tuomas Räsänen discovered that unsafe signal handling in nbd-server, the server for the Network Block Device protocol, could allow remote attackers to cause a deadlock in the server process and thus a denial of service.
Tuomas Räsänen also discovered that the modern-style negotiation was carried out in the main server process before forking the actual client handler. This could allow a remote attacker to cause a denial of service (crash) by querying a non-existent export. This issue only affected the oldstable distribution (wheezy).
For the oldstable distribution (wheezy), these problems have been fixed in version 1:3.2-4~deb7u5.
For the stable distribution (jessie), these problems have been fixed in version 1:3.8-4+deb8u1.
For the testing distribution (stretch), these problems have been fixed in version 1:3.10-1.
For the unstable distribution (sid), these problems have been fixed in version 1:3.10-1.
We recommend that you upgrade your nbd packages.