5 - MDVSA-2010:131

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	MDVSA-2010:131	First vendor Publication	2010-07-12
Vendor	Mandriva	Last vendor Modification	2010-07-12
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple format string and buffer overflow vulnerabilities has been found and corrected in iscsitarget (CVE-2010-0743, CVE-2010-2221).

The updated packages have been patched to correct these issues.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2010:131

CWE : Common Weakness Enumeration

%	Id	Name
50 %	CWE-134	Uncontrolled Format String (CWE/SANS Top 25)
50 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11248

Oval ID:	oval:org.mitre.oval:def:11248
Title:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Description:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2010-0743	Version:	5
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:13055

Oval ID:	oval:org.mitre.oval:def:13055
Title:	DSA-2042-1 iscsitarget -- format string
Description:	Florent Daigniere discovered multiple format string vulnerabilities in Linux SCSI target framework allow remote attackers to cause a denial of service in the ietd daemon. The flaw could be trigger by sending a carefully-crafted Internet Storage Name Service request. For the stable distribution, this problem has been fixed in version 0.4.16+svn162-3.1+lenny1. For the testing distribution, this problem has been fixed in version 0.4.17+svn229-1.4. For the unstable distribution, this problem has been fixed in version 0.4.17+svn229-1.4.
Family:	unix	Class:	patch
Reference(s):	DSA-2042-1 CVE-2010-0743	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	iscsitarget
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independet section Installed architecture is all AND iscsitarget-source DPKG is earlier than 0.4.16+svn162-3.1+lenny1 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND iscsitarget DPKG is earlier than 0.4.16+svn162-3.1+lenny1

Definition Id: oval:org.mitre.oval:def:22132

Oval ID:	oval:org.mitre.oval:def:22132
Title:	RHSA-2010:0362: scsi-target-utils security update (Important)
Description:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Family:	unix	Class:	patch
Reference(s):	RHSA-2010:0362-01 CESA-2010:0362 CVE-2010-0743	Version:	4
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:22141

Oval ID:	oval:org.mitre.oval:def:22141
Title:	RHSA-2010:0518: scsi-target-utils security update (Important)
Description:	Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or iscsi-scst) 1.0.1.1 and earlier allow remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via (a) a long iSCSI Name string in an SCN message or (b) an invalid PDU.
Family:	unix	Class:	patch
Reference(s):	RHSA-2010:0518-01 CESA-2010:0518 CVE-2010-2221	Version:	4
Platform(s):	Red Hat Enterprise Linux 5 CentOS Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Redhat 5 or Centos 5 release The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.3

Definition Id: oval:org.mitre.oval:def:23001

Oval ID:	oval:org.mitre.oval:def:23001
Title:	ELSA-2010:0362: scsi-target-utils security update (Important)
Description:	Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Family:	unix	Class:	patch
Reference(s):	ELSA-2010:0362-01 CVE-2010-0743	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:23038

Oval ID:	oval:org.mitre.oval:def:23038
Title:	ELSA-2010:0518: scsi-target-utils security update (Important)
Description:	Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or iscsi-scst) 1.0.1.1 and earlier allow remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via (a) a long iSCSI Name string in an SCN message or (b) an invalid PDU.
Family:	unix	Class:	patch
Reference(s):	ELSA-2010:0518-01 CVE-2010-2221	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.3

Definition Id: oval:org.mitre.oval:def:26417

Oval ID:	oval:org.mitre.oval:def:26417
Title:	DEPRECATED: ELSA-2010-0362 -- scsi-target-utils security update (important)
Description:	[0.0-6.20091205snap.2] - 576359 Fix format string vulnerability (CVE-2010-0743)
Family:	unix	Class:	patch
Reference(s):	ELSA-2010-0362 CVE-2010-0743	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.2

Definition Id: oval:org.mitre.oval:def:26560

Oval ID:	oval:org.mitre.oval:def:26560
Title:	DEPRECATED: ELSA-2010-0518 -- scsi-target-utils security update (important)
Description:	[0.0-6.20091205snap.3] - Fix buffer overflow in isns scn handling (CVE-2010-2221)
Family:	unix	Class:	patch
Reference(s):	ELSA-2010-0518 CVE-2010-2221	Version:	4
Platform(s):	Oracle Linux 5	Product(s):	scsi-target-utils
Definition Synopsis:
Oracle Linux 5.x AND scsi-target-utils is earlier than 0:0.0-6.20091205snap.el5_5.3

Definition Id: oval:org.mitre.oval:def:6714

Oval ID:	oval:org.mitre.oval:def:6714
Title:	DSA-2042 iscsitarget -- format string
Description:	Florent Daigniere discovered multiple format string vulnerabilities in Linux SCSI target framework allow remote attackers to cause a denial of service in the ietd daemon. The flaw could be trigger by sending a carefully-crafted Internet Storage Name Service request.
Family:	unix	Class:	patch
Reference(s):	DSA-2042 CVE-2010-0743	Version:	5
Platform(s):	Debian GNU/Linux 5.0	Product(s):	iscsitarget
Definition Synopsis:
Debian GNU/Linux 5.0 is installed Architecture section Architecture independent section Installed architecture is all AND iscsitarget-source is earlier than 0.4.16+svn162-3.1+lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND iscsitarget is earlier than 0.4.16+svn162-3.1+lenny1

CPE : Common Platform Enumeration

Type	Description	Count
Application	Iscsitarget cpe:2.3:a:iscsitarget:iscsitarget:0.4.16:::::::*	1
Application	Vladislav Bolkhovitin Generic Scsi Target Subsystem cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:1.0.1:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:1.0.0:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.5.2:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.5.1:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.5:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.4:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.3:pre4:::::: cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.3:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.3:pre2:::::: cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.3:pre1:::::: cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.2:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.1:::::::* cpe:2.3:a:vladislav_bolkhovitin:generic_scsi_target_subsystem:0.9.0a:::::::*	13
Application	Zaal Tgt cpe:2.3:a:zaal:tgt:1.0.5:::::::* cpe:2.3:a:zaal:tgt:1.0.4:::::::* cpe:2.3:a:zaal:tgt:1.0.3:::::::* cpe:2.3:a:zaal:tgt:1.0.2:::::::* cpe:2.3:a:zaal:tgt:1.0.1:::::::* cpe:2.3:a:zaal:tgt:1.0.0:::::::* cpe:2.3:a:zaal:tgt:0.9.5:::::::*	7

OpenVAS Exploits

Date	Description
2012-02-12	Name : Gentoo Security Advisory GLSA 201201-06 (iscsitarget) File : nvt/glsa_201201_06.nasl
2011-08-09	Name : CentOS Update for scsi-target-utils CESA-2010:0362 centos5 i386 File : nvt/gb_CESA-2010_0362_scsi-target-utils_centos5_i386.nasl
2011-08-09	Name : CentOS Update for scsi-target-utils CESA-2010:0518 centos5 i386 File : nvt/gb_CESA-2010_0518_scsi-target-utils_centos5_i386.nasl
2011-07-18	Name : Fedora Update for scsi-target-utils FEDORA-2011-8930 File : nvt/gb_fedora_2011_8930_scsi-target-utils_fc14.nasl
2011-06-24	Name : Ubuntu Update for tgt USN-1156-1 File : nvt/gb_ubuntu_USN_1156_1.nasl
2010-07-16	Name : Mandriva Update for iscsitarget MDVSA-2010:131 (iscsitarget) File : nvt/gb_mandriva_MDVSA_2010_131.nasl
2010-05-14	Name : Debian Security Advisory DSA 2042-1 (iscsitarget) File : nvt/deb_2042_1.nasl
2010-04-30	Name : Mandriva Update for yelp MDVA-2010:131 (yelp) File : nvt/gb_mandriva_MDVA_2010_131.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
65991	Linux SCSI Target Framework (tgt) iSNS Message Remote Overflow
65990	Generic SCSI Target Subsystem for Linux (SCST) iSNS Message Remote Overflow
63418	Linux SCSI Target Framework (tgt) usr/iscsi/isns.c Multiple Function Format S...

Snort® IPS/IDS

Date	Description
2017-11-30	iSCSI target multiple implementations iSNS stack buffer overflow attempt RuleID : 44675 - Revision : 1 - Type : SERVER-OTHER
2014-01-10	iSCSI target multiple implementations iSNS stack buffer overflow attempt RuleID : 17138 - Revision : 7 - Type : SERVER-OTHER
2014-01-10	iscsi target format string code execution attempt RuleID : 16688 - Revision : 8 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date	Description
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_tgt-100805.nasl - Type : ACT_GATHER_INFO
2014-06-13	Name : The remote openSUSE host is missing a security update. File : suse_11_3_iscsitarget-100805.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2010-0362.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2010-0518.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0362.nasl - Type : ACT_GATHER_INFO
2013-01-24	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2010-0518.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100420_scsi_target_utils_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20100708_scsi_target_utils_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-01-24	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201201-06.nasl - Type : ACT_GATHER_INFO
2011-06-21	Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1156-1.nasl - Type : ACT_GATHER_INFO
2011-01-21	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_iscsitarget-100903.nasl - Type : ACT_GATHER_INFO
2010-12-02	Name : The remote SuSE 11 host is missing a security update. File : suse_11_tgt-100819.nasl - Type : ACT_GATHER_INFO
2010-12-02	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_iscsitarget-100804.nasl - Type : ACT_GATHER_INFO
2010-10-11	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_iscsitarget-7109.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_1_iscsitarget-100804.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_2_tgt-100805.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_2_iscsitarget-100805.nasl - Type : ACT_GATHER_INFO
2010-09-14	Name : The remote openSUSE host is missing a security update. File : suse_11_1_tgt-100805.nasl - Type : ACT_GATHER_INFO
2010-07-16	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2010-0518.nasl - Type : ACT_GATHER_INFO
2010-06-01	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2010-0362.nasl - Type : ACT_GATHER_INFO
2010-05-07	Name : The remote Debian host is missing a security-related update. File : debian_DSA-2042.nasl - Type : ACT_GATHER_INFO

Global Informations

Type	Count
CWE ID(s)	2
Oval ID(s)	9
CPE ID(s)	21
osvdb(s)	3
Openvas Exploit(s)	8
Snort® Rule(s)	3
Nessus® Exploit(s)	21

	Related
5	CVE-2010-2221
5	CVE-2010-0743
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)