Stay Secure with the Latest Linux Advisories

security advisorydenial of servicelow severity

Arch Linux 2015-05-15 Advisory: Low Severity Denial Of Service Risk

The package nbd before version 3.11-1 is vulnerable to denial of service. . Arch Linux Security Advisory ASA-201505-15 ========================================= Severity: Low Date : 2015-05-26 CVE-ID : CVE-2015-0847 Package : nbd Type : denial of service Remote : Yes Link : https://wiki.archlinux.org/title/CVE Summary ====== The package nbd before version 3.11-1 is vulnerable to denial of service. Resolution ========= Upgrade to 3.11-1. # pacman -Syu "nbd> =3.11-1" The problem has been fixed upstream in version 3.11. Workaround ========= None. Description ========== Signal handlers themselves were entered only once, but they called posixly unsafe, non-reentrant functions, such as syslog(). If a signal was caught in the middle of the execution of such function, consequences were undefined. In practice, nbd-server was observed to deadlock during the execution of sigchld_handler(). Impact ===== A remote attacker is able to send requests to the nbd server that may lead to a deadlock resulting in denial of service. References ========= https://access.redhat.com/security/cve/CVE-2015-0847 https://github.com/NetworkBlockDevice/nbd/commit/412def . Arch Linux has released a security update for the nbd package. This update addresses a low severity denial of service vulnerability.. Arch Linux, NBD Package, Denial Of Service. . Severity: Low. LinuxSecurity.com Team

May 26, 2015 •Low ArchLinux