A Debian bug report [1] reported two remotely exploitable format string vulnerabilities in iscsitarget. We do not provide iscsitarget, but similar code exists in scsi-target-utils (isns.c):
rqs 0.3 ($Id: rqp 349 2010-03-19 23:05:04Z vdanen $)
Searching database records for substring match on files ("/isns.c")
Results in Tag: f11
iscsi-initiator-utils-6.2.0.870-8.fc11: (source) open-iscsi-2.0-870.1.tar.gz: open-iscsi-2.0-870.1/usr/isns.c scsi-target-utils-0.9.5-1.fc11: (source) tgt-0.9.5.tar.bz2: tgt-0.9.5/usr/iscsi/isns.c
Results in Tag: f12
iscsi-initiator-utils-6.2.0.870-10.fc12.1: (source) open-iscsi-2.0-870.1.tar.gz: open-iscsi-2.0-870.1/usr/isns.c scsi-target-utils-0.9.5-3.fc12: (source) tgt-0.9.5.tar.bz2: tgt-0.9.5/usr/iscsi/isns.c
Results in Tag: rhel5
iscsi-initiator-utils-6.2.0.871-0.10.el5: (source) open-iscsi-2.0-871-test4.bnx2i.tar.gz: open-iscsi-2.0-871-test4.bnx2i/usr/isns.c scsi-target-utils-0.0-5.20080917snap.el5: (source) tgt-20080917.tar.bz2: tgt-20080917/usr/iscsi/isns.c
The problem is a few snprintf() statements that don't use format strings (there are 3 in total in this file in iscsitarget, only 1 of which is correct). Checking to see if the same issues are in the RHEL5 iscsi-initiator-utils yielded nothing (one correct use):
% grep snprintf usr/isns.c snprintf(port, sizeof(port), "%d", isnsport);
Unfortunately, this does affect scsi-target-utils:
% grep snprintf usr/iscsi/isns.c snprintf(mgmt->name, sizeof(mgmt->name), name); snprintf(ini->name, sizeof(ini->name), name); snprintf(port, sizeof(port), "%d", isnsport);
It is unclear to me whether this is remotely exploitable, but the Debian report implies that it is. With our format string protections, this would not result in arbitrary code execution, but in a denial of service (crash) condition. This also affects the version shipped with Fedora 12, so I presume Fedora 11 would be vulnerable to this as well.
[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574935
It was reported that a stack buffer overflow vulnerability exists in multiple implementations of iSCSI target, including scsi-target-utils. A missing bounds check when handling SCN messages could result in a buffer overflow when the iSCSI Name string is longer than 1008 bytes, which could lead to corruption of sensitive stack data. During investigation, more buffer overflow vulnerabilities were discovered as well.
Acknowledgements:
Red Hat would like to thank the Vulnerability Research Team at TELUS Security Labs and Fujita Tomonori for responsibly reporting these flaws.
Double free vulnerability in the iscsirxhandler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login. NOTE: some of these details are obtained from third party information.