CVE-2007-3099: Low severity redhat Enterprise Linux vulnerability

Published Jun 14, 2007

Updated

usr/mgmtipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AFLOCAL socket instead of the new connection, which allows remote attackers to access the management interface and cause a denial of service (iscsid exit or iSCSI connection loss).

Affected Software

2 affected components

redhat Enterprise Linux=5.0

Remediation

Patch Available

http://secunia.com/advisories/25679

Event History

Jun 14, 2007

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-3099?

CVE-2007-3099 has a moderate severity as it can lead to a denial of service through access to the management interface.

How do I fix CVE-2007-3099?

To fix CVE-2007-3099, upgrade to open-iscsi version 2.0-865 or later, where the UID check has been appropriately addressed.

What software is affected by CVE-2007-3099?

CVE-2007-3099 affects open-iscsi on Red Hat Enterprise Linux 5.0 for both desktop and server installations.

Can CVE-2007-3099 be exploited remotely?

Yes, CVE-2007-3099 can be exploited remotely by attackers to access the management interface.

What is the primary impact of CVE-2007-3099?

The primary impact of CVE-2007-3099 is the potential for denial of service, causing iscsid to exit or iSCSI connections to be lost.