Hat-Squad Advisory: BakBone NetVault Remote Heap and Local Buffer Overflow April 1, 2005 Product: BakBone NetVault Vendor URL: http://www.bakbone.com Version: NetVault 7.x, 6.x Vulnerability: Remote and Local Heap Buffer overflows Release Date:1 April 2005 Vendor Status: 17-3-2005: vendor notified #1/3 18-3-2005: vendor notified #2/3 19-3-2005: vendor notified #3/3 21-3-2005: vendor RE-notification #1/1 24-3-2005: vendor wake up Response: I'm on a business trip! Description: NetVault is a professional backup and restore solution for eterogeneous UNIX, Windows NT/2000, Linux and Netware enterprise environments.With NetVault you can rapidly add and configure new servers, devices and clients, and control them from a central location. Details:a Problem details could be found at: http://www.class101.org/netv-remhbof.pdf (remote overflow) http://www.class101.org/netv-locsbof.pdf (local overflow) For proof of concepts (both remote and local) please visit: http://class101.org/36/55/op.php http://www.hat-squad.com Solution: At the moment of writing this advisory, no patch is released, we can only suggest to : 1- Restrict all incoming connections to 20031/tcp and 20031/udp, a fix might come very soon. 2- set STRICTS ACL rules, for example, allow ONLY SYSTEM to write in configure.cfg. This will protect against Local attack. Credits: This Vulnerability has been Discoverd By class101 (class101@hat- squad.com) Disclaimer: This Advisory is provided on an "AS IS" basis and does not imply any kind of guarantee or warranty. Neither the author nor the publisher accepts any liability for any direct, indirect,or consequential loss or damage arising from use of, or reliance on, this informations.