Vulnerabilities > CVE-2005-1009 - Remote Heap Overflow vulnerability in Bakbone Netvault 7.0/7.1

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
bakbone
critical
nessus
exploit available
metasploit
NVD
Published: 2005-05-02
Updated: 2017-07-11

Summary

Multiple buffer overflows in BakBone NetVault 6.x and 7.x allow (1) remote attackers to execute arbitrary code via a modified computer name and length that leads to a heap-based buffer overflow, or (2) local users to execute arbitrary code via a long Name entry in the configure.cfg file.

Vulnerable Configurations

Part Description Count
Application
Bakbone
2

Exploit-Db

  • descriptionBakBone NetVault Remote Heap Overflow. CVE-2005-1009. Remote exploit for windows platform
    idEDB-ID:16448
    last seen2016-02-01
    modified2010-09-20
    published2010-09-20
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16448/
    titleBakBone NetVault Remote Heap Overflow
  • descriptionBakBone NetVault 6.x/7.x Remote Heap Buffer Overflow. CVE-2005-1009,CVE-2005-1547. Remote exploit for windows platform
    idEDB-ID:990
    last seen2016-01-31
    modified2005-05-17
    published2005-05-17
    reporternolimit
    sourcehttps://www.exploit-db.com/download/990/
    titleBakBone NetVault 6.x/7.x - Remote Heap Buffer Overflow
  • descriptionBakBone NetVault 6.x/7.x Remote Heap Buffer Overflow Exploit (2). CVE-2005-1009. Remote exploit for windows platform
    idEDB-ID:906
    last seen2016-01-31
    modified2005-04-01
    published2005-04-01
    reporterclass101
    sourcehttps://www.exploit-db.com/download/906/
    titleBakBone NetVault 6.x/7.x - Remote Heap Buffer Overflow Exploit 2
  • descriptionBakBone NetVault 6.x/7.x Local Stack Buffer Overflow Exploit. CVE-2005-1009. Local exploit for windows platform
    idEDB-ID:905
    last seen2016-01-31
    modified2005-04-01
    published2005-04-01
    reporterclass101
    sourcehttps://www.exploit-db.com/download/905/
    titleBakBone NetVault 6.x/7.x - Local Stack Buffer Overflow Exploit

Metasploit

descriptionThis module exploits a heap overflow in the BakBone NetVault Process Manager service. This code is a direct port of the netvault.c code written by nolimit and BuzzDee.
idMSF:EXPLOIT/WINDOWS/MISC/BAKBONE_NETVAULT_HEAP
last seen2020-03-11
modified2017-07-24
published2006-12-28
referenceshttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1009
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/misc/bakbone_netvault_heap.rb
titleBakBone NetVault Remote Heap Overflow

Nessus

NASL familyGain a shell remotely
NASL idNETVAULT_REMOTE_HBOF.NASL
descriptionThe installed version of BakBone NetVault on the remote host suffers from two remote heap-based buffer overflow vulnerabilities. An attacker may be able to exploit these flaws and execute arbitrary code with SYSTEM privileges on the affected machine.
last seen2020-06-01
modified2020-06-02
plugin id18257
published2005-05-14
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/18257
titleBakBone NetVault < 7.1.2 / 7.3.1 Multiple Remote Overflows
code
#
# (C) Tenable Network Security, Inc.
#



include("compat.inc");

if (description) {
  script_id(18257);
  script_version("1.24");

  script_cve_id("CVE-2005-1009", "CVE-2005-1547");
  script_bugtraq_id(12967, 13594, 13618);

  script_name(english:"BakBone NetVault < 7.1.2 / 7.3.1 Multiple Remote Overflows");

 script_set_attribute(attribute:"synopsis", value:
"The remote backup server is affected by multiple overflow flaws." );
 script_set_attribute(attribute:"description", value:
"The installed version of BakBone NetVault on the remote host suffers
from two remote heap-based buffer overflow vulnerabilities.  An
attacker may be able to exploit these flaws and execute arbitrary code
with SYSTEM privileges on the affected machine." );
 script_set_attribute(attribute:"see_also", value:"http://www.hat-squad.com/en/000164.html" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/132" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/166" );
 script_set_attribute(attribute:"see_also", value:"http://www.bakbone.com/docs/NetVault_Release_Notes_(712).pdf" );
 script_set_attribute(attribute:"see_also", value:"http://www.bakbone.com/docs/NetVault_Release_Notes_(731).pdf" );
 script_set_attribute(attribute:"solution", value:
"Upgrade to BackBone NetVault 7.1.2 / 7.3.1 or later." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_set_attribute(attribute:"metasploit_name", value:'BakBone NetVault Remote Heap Overflow');
 script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
 script_set_attribute(attribute:"plugin_publication_date", value: "2005/05/14");
 script_set_attribute(attribute:"vuln_publication_date", value: "2005/04/02");
 script_cvs_date("Date: 2018/11/15 20:50:22");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe",value:"cpe:/a:bakbone:netvault");
script_end_attributes();


  script_summary(english:"Checks for remote heap overflow vulnerabilities in BakBone NetVault");
  script_category(ACT_GATHER_INFO);
  script_family(english:"Gain a shell remotely");
  script_copyright(english:"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.");
  script_dependencies("netvault_detect.nasl");
  script_require_ports("Services/nvpmgr");

  exit(0);
}


port = get_kb_item("Services/nvpmgr");
if (!get_port_state(port)) exit(0);


# Get the version number of NetVault on the remote.
nvver = get_kb_item("NetVault/"+port+"/NVVersion");
nvbuild = get_kb_item("NetVault/"+port+"/NVBuild");
if (isnull(nvver) || isnull(nvbuild)) exit(0);

ver = string(nvver[0], ".", nvver[2], nvver[3], " Build ", nvbuild);
if (ver =~ "^(6\.|7\.(0\.|1\.[01]|3\.0))") security_hole(port);

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/83217/bakbone_netvault_heap.rb.txt
idPACKETSTORM:83217
last seen2016-12-05
published2009-11-26
reporterH D Moore
sourcehttps://packetstormsecurity.com/files/83217/BakBone-NetVault-Remote-Heap-Overflow.html
titleBakBone NetVault Remote Heap Overflow

Saint

bid12967
descriptionBakBone NetVault remote heap overflow
idmisc_netvault
osvdb15234
titlenetvault_heap_overflow
typeremote

References