5 - GLSA-201201-06

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Summary
Title	iSCSI Enterprise Target: Arbitrary code execution

Informations
Name	GLSA-201201-06	First vendor Publication	2012-01-23
Vendor	Gentoo	Last vendor Modification	2012-01-23
Severity (Vendor)	High	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

Format string vulnerabilities in iSCSI Enterprise Target could result in execution of arbitrary code or a Denial of Service.

Background

iSCSI Enterprise Target is an open source iSCSI target with professional features.

Description

Multiple functions in usr/iscsi/isns.c of iSCSI Enterprise Target contain format string errors.

Impact

A remote attacker could send a specially-crafted Internet Storage Name Service (iSNS) request, possibly resulting in the execution of arbitrary code with root privileges or cause a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All iSCSI Enterprise Target users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=sys-block/iscsitarget-1.4.19"

NOTE: This is a legacy GLSA. Updates for all affected architectures are available since August 11, 2010. It is likely that your system is already no longer affected by this issue.

References

[ 1 ] CVE-2010-0743 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-0743

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-201201-06.xml

Original Source

Url : http://security.gentoo.org/glsa/glsa-201201-06.xml

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-134	Uncontrolled Format String (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11248

Oval ID:	oval:org.mitre.oval:def:11248
Title:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Description:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-0743	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:13055

Oval ID:	oval:org.mitre.oval:def:13055
Title:	DSA-2042-1 iscsitarget -- format string
Description:	Florent Daigniere discovered multiple format string vulnerabilities in Linux SCSI target framework allow remote attackers to cause a denial of service in the ietd daemon. The flaw could be trigger by sending a carefully-crafted Internet Storage Name Service request. For the stable distribution, this problem has been fixed in version 0.4.16+svn162-3.1+lenny1. For the testing distribution, this problem has been fixed in version 0.4.17+svn229-1.4. For the unstable distribution, this problem has been fixed in version 0.4.17+svn229-1.4.
Family:	unix	Class:	patch
Reference(s):	DSA-2042-1 CVE-2010-0743	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	iscsitarget
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independet section Installed architecture is all AND iscsitarget-source DPKG is earlier than 0.4.16+svn162-3.1+lenny1 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND iscsitarget DPKG is earlier than 0.4.16+svn162-3.1+lenny1

Definition Id: oval:org.mitre.oval:def:22132

Oval ID:	oval:org.mitre.oval:def:22132
Title:	RHSA-2010:0362: scsi-target-utils security update (Important)
Description:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Family:	unix	Class:	patch
Reference(s):	RHSA-2010:0362-01 CESA-2010:0362 CVE-2010-0743	Version:	4
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:23001

Oval ID:	oval:org.mitre.oval:def:23001
Title:	ELSA-2010:0362: scsi-target-utils security update (Important)
Description:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Family:	unix	Class:	patch
Reference(s):	ELSA-2010:0362-01 CVE-2010-0743	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:26417

Oval ID:	oval:org.mitre.oval:def:26417
Title:	DEPRECATED: ELSA-2010-0362 -- scsi-target-utils security update (important)
Description:	[0.0-6.20091205snap.2] - 576359 Fix format string vulnerability (CVE-2010-0743)
Family:	unix	Class:	patch
Reference(s):	ELSA-2010-0362 CVE-2010-0743	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:6714

Oval ID:	oval:org.mitre.oval:def:6714
Title:	DSA-2042 iscsitarget -- format string
Description:	Florent Daigniere discovered multiple format string vulnerabilities in Linux SCSI target framework allow remote attackers to cause a denial of service in the ietd daemon. The flaw could be trigger by sending a carefully-crafted Internet Storage Name Service request.
Family:	unix	Class:	patch
Reference(s):	DSA-2042 CVE-2010-0743	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	iscsitarget
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND iscsitarget-source is earlier than 0.4.16+svn162-3.1+lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND iscsitarget is earlier than 0.4.16+svn162-3.1+lenny1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Iscsitarget cpe:2.3:a:iscsitarget:iscsitarget:0.4.16:::::::*	1
Application	Zaal Tgt cpe:2.3:a:zaal:tgt:1.0.3:::::::* cpe:2.3:a:zaal:tgt:0.9.5:::::::*	2

OpenVAS Exploits

Date	Description
2012-02-12	Name : Gentoo Security Advisory GLSA 201201-06 (iscsitarget) File : nvt/glsa_201201_06.nasl
2011-08-09	Name : CentOS Update for scsi-target-utils CESA-2010:0362 centos5 i386 File : nvt/gb_CESA-2010_0362_scsi-target-utils_centos5_i386.nasl
2010-07-16	Name : Mandriva Update for iscsitarget MDVSA-2010:131 (iscsitarget) File : nvt/gb_mandriva_MDVSA_2010_131.nasl
2010-05-14	Name : Debian Security Advisory DSA 2042-1 (iscsitarget) File : nvt/deb_2042_1.nasl
2010-04-30	Name : Mandriva Update for yelp MDVA-2010:131 (yelp) File : nvt/gb_mandriva_MDVA_2010_131.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
63418	Linux SCSI Target Framework (tgt) usr/iscsi/isns.c Multiple Function Format S...

Snort® IPS/IDS

Date	Description
2014-01-10	iscsi target format string code execution attempt RuleID : 16688 - Revision : 8 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date	Description
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_iscsitarget-100805.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_tgt-100805.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2010-0362.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0362.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100420_scsi_target_utils_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-01-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201201-06.nasl - Type : ACT_GATHER_INFO
2011-01-21	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_iscsitarget-100903.nasl - Type : ACT_GATHER_INFO
2010-12-02	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_iscsitarget-100804.nasl - Type : ACT_GATHER_INFO
2010-12-02	Name : The remote SuSE 11 host is missing a security update. File : suse_11_tgt-100819.nasl - Type : ACT_GATHER_INFO
2010-10-11	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_iscsitarget-7109.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_1_iscsitarget-100804.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_1_tgt-100805.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_2_iscsitarget-100805.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_2_tgt-100805.nasl - Type : ACT_GATHER_INFO
2010-06-01	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2010-0362.nasl - Type : ACT_GATHER_INFO
2010-05-07	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2042.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:37:08	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	6
CPE ID(s)	3
osvdb(s)	1
Openvas Exploit(s)	5
Snort® Rule(s)	1
Nessus® Exploit(s)	16

	Related
5	CVE-2010-0743
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)