CVE-2010-0743: Medium severity Zaal Tgt vulnerability
A Debian bug report [1] reported two remotely exploitable format string vulnerabilities in iscsitarget. We do not provide iscsitarget, but similar code exists in scsi-target-utils (isns.c):
rqs 0.3 ($Id: rqp 349 2010-03-19 23:05:04Z vdanen $)
Searching database records for substring match on files ("/isns.c")
Results in Tag: f11
iscsi-initiator-utils-6.2.0.870-8.fc11: (source) open-iscsi-2.0-870.1.tar.gz: open-iscsi-2.0-870.1/usr/isns.c scsi-target-utils-0.9.5-1.fc11: (source) tgt-0.9.5.tar.bz2: tgt-0.9.5/usr/iscsi/isns.c
Results in Tag: f12
iscsi-initiator-utils-6.2.0.870-10.fc12.1: (source) open-iscsi-2.0-870.1.tar.gz: open-iscsi-2.0-870.1/usr/isns.c scsi-target-utils-0.9.5-3.fc12: (source) tgt-0.9.5.tar.bz2: tgt-0.9.5/usr/iscsi/isns.c
Results in Tag: rhel5
iscsi-initiator-utils-6.2.0.871-0.10.el5: (source) open-iscsi-2.0-871-test4.bnx2i.tar.gz: open-iscsi-2.0-871-test4.bnx2i/usr/isns.c scsi-target-utils-0.0-5.20080917snap.el5: (source) tgt-20080917.tar.bz2: tgt-20080917/usr/iscsi/isns.c
The problem is a few snprintf() statements that don't use format strings (there are 3 in total in this file in iscsitarget, only 1 of which is correct). Checking to see if the same issues are in the RHEL5 iscsi-initiator-utils yielded nothing (one correct use):
% grep snprintf usr/isns.c snprintf(port, sizeof(port), "%d", isnsport);
Unfortunately, this does affect scsi-target-utils:
% grep snprintf usr/iscsi/isns.c snprintf(mgmt->name, sizeof(mgmt->name), name); snprintf(ini->name, sizeof(ini->name), name); snprintf(port, sizeof(port), "%d", isnsport);
It is unclear to me whether this is remotely exploitable, but the Debian report implies that it is. With our format string protections, this would not result in arbitrary code execution, but in a denial of service (crash) condition. This also affects the version shipped with Fedora 12, so I presume Fedora 11 would be vulnerable to this as well.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574935
Other sources
Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isnsattrquery and qryrsphandle functions, and are related to (a) client appearance and (b) client disappearance messages.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0743?
CVE-2010-0743 is classified as a high-severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2010-0743?
To fix CVE-2010-0743, upgrade the affected 'scsi-target-utils' package to a version that is not vulnerable.
What systems are affected by CVE-2010-0743?
CVE-2010-0743 affects systems utilizing versions of 'scsi-target-utils' up to 0:0.0-6.20091205snap.el5_5.2 and certain versions of 'tgt' and 'iscsitarget' packages.
What type of vulnerability is CVE-2010-0743?
CVE-2010-0743 is a remotely exploitable format string vulnerability.
Is my installation vulnerable to CVE-2010-0743?
If you are using affected versions of 'scsi-target-utils', 'tgt', or 'iscsitarget', your installation may be vulnerable to CVE-2010-0743.