Vulnerability in Wouter Verhelst Nbd

CVE-2013-6410

nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file.

EPSS: 0.025 (83.3th percentile) — read the EPSS interpretation.

Affected products

Wouter_verhelst Nbd — versions 2.7.5, 2.8.0, 2.8.2
Canonical Ubuntu_linux — versions 12.04, 14.04, 14.10
Debian Debian_linux — versions 6.0, 7.0
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Mailing List, Third Party Advisory)
secalert@redhat.com (mailing-list, x_refsource_MLIST, Patch)
secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_DEBIAN)