Vulnerabilities > CVE-2005-1547 - Remote Security vulnerability in Bakbone Netvault 7.3

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
bakbone
nessus
exploit available
NVD
Published: 2005-05-14
Updated: 2016-10-18

Summary

Heap-based buffer overflow in the demo version of Bakbone Netvault, and possibly other versions, allows remote attackers to execute arbitrary commands via a large packet to port 20031.

Vulnerable Configurations

Part Description Count
Application
Bakbone
1

Exploit-Db

descriptionBakBone NetVault 6.x/7.x Remote Heap Buffer Overflow. CVE-2005-1009,CVE-2005-1547. Remote exploit for windows platform
idEDB-ID:990
last seen2016-01-31
modified2005-05-17
published2005-05-17
reporternolimit
sourcehttps://www.exploit-db.com/download/990/
titleBakBone NetVault 6.x/7.x - Remote Heap Buffer Overflow

Nessus

NASL familyGain a shell remotely
NASL idNETVAULT_REMOTE_HBOF.NASL
descriptionThe installed version of BakBone NetVault on the remote host suffers from two remote heap-based buffer overflow vulnerabilities. An attacker may be able to exploit these flaws and execute arbitrary code with SYSTEM privileges on the affected machine.
last seen2020-06-01
modified2020-06-02
plugin id18257
published2005-05-14
reporterThis script is Copyright (C) 2005-2018 Tenable Network Security, Inc.
sourcehttps://www.tenable.com/plugins/nessus/18257
titleBakBone NetVault < 7.1.2 / 7.3.1 Multiple Remote Overflows
code
#
# (C) Tenable Network Security, Inc.
#



include("compat.inc");

if (description) {
  script_id(18257);
  script_version("1.24");

  script_cve_id("CVE-2005-1009", "CVE-2005-1547");
  script_bugtraq_id(12967, 13594, 13618);

  script_name(english:"BakBone NetVault < 7.1.2 / 7.3.1 Multiple Remote Overflows");

 script_set_attribute(attribute:"synopsis", value:
"The remote backup server is affected by multiple overflow flaws." );
 script_set_attribute(attribute:"description", value:
"The installed version of BakBone NetVault on the remote host suffers
from two remote heap-based buffer overflow vulnerabilities.  An
attacker may be able to exploit these flaws and execute arbitrary code
with SYSTEM privileges on the affected machine." );
 script_set_attribute(attribute:"see_also", value:"http://www.hat-squad.com/en/000164.html" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/132" );
 script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2005/May/166" );
 script_set_attribute(attribute:"see_also", value:"http://www.bakbone.com/docs/NetVault_Release_Notes_(712).pdf" );
 script_set_attribute(attribute:"see_also", value:"http://www.bakbone.com/docs/NetVault_Release_Notes_(731).pdf" );
 script_set_attribute(attribute:"solution", value:
"Upgrade to BackBone NetVault 7.1.2 / 7.3.1 or later." );
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
 script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");
 script_set_attribute(attribute:"metasploit_name", value:'BakBone NetVault Remote Heap Overflow');
 script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
 script_set_attribute(attribute:"plugin_publication_date", value: "2005/05/14");
 script_set_attribute(attribute:"vuln_publication_date", value: "2005/04/02");
 script_cvs_date("Date: 2018/11/15 20:50:22");
script_set_attribute(attribute:"plugin_type", value:"remote");
script_set_attribute(attribute:"cpe",value:"cpe:/a:bakbone:netvault");
script_end_attributes();


  script_summary(english:"Checks for remote heap overflow vulnerabilities in BakBone NetVault");
  script_category(ACT_GATHER_INFO);
  script_family(english:"Gain a shell remotely");
  script_copyright(english:"This script is Copyright (C) 2005-2018 Tenable Network Security, Inc.");
  script_dependencies("netvault_detect.nasl");
  script_require_ports("Services/nvpmgr");

  exit(0);
}


port = get_kb_item("Services/nvpmgr");
if (!get_port_state(port)) exit(0);


# Get the version number of NetVault on the remote.
nvver = get_kb_item("NetVault/"+port+"/NVVersion");
nvbuild = get_kb_item("NetVault/"+port+"/NVBuild");
if (isnull(nvver) || isnull(nvbuild)) exit(0);

ver = string(nvver[0], ".", nvver[2], nvver[3], " Build ", nvbuild);
if (ver =~ "^(6\.|7\.(0\.|1\.[01]|3\.0))") security_hole(port);

References