Title: BakBone NetVault Remote Heap Overflow Vulnerability
Severity: CRITICAL
Description:
NetVault is a backup and restore solution available for UNIX, Windows NT/2000, Linux, Netware and Apple Mac OS X platforms.
NetVault is reported prone to a remote heap overflow vulnerability. This issue arises because the application fails to perform boundary checks prior to copying user-supplied data in to sensitive process buffers.
It is reported that a remote attacker can exploit this vulnerability by supplying excessive data through the 'Clientname' variable used by the application. This value is thought to be used as the identify of a client during a connection attempt by the communication protocol used by Netvault.
A successful attack can allow remote attackers to execute arbitrary code on a vulnerable computer to gain unauthorized access.
This issue has been confirmed in NetVault 7 packages running on Windows platforms. Other versions of NetVault running on different platforms may be affected as well.
Affected Products:
- BakBone NetVault 7.0.0
- BakBone NetVault 7.1.0
References:
- BakBone: BakBone Home Page
- Hat-Squad: BakBone NetVault Remote Heap Buffer Overflow
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
