National Cyber Awareness System

Vulnerability Summary for CVE-2010-0743

Overview

Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://git.kernel.org/?p=linux/kernel/git/tomo/tgt.git;a=commit;h=107d922706cd36f3bb79bcca9bc4678c32f22e59

Type: Patch Information

Hyperlink:http://git.kernel.org/?p=linux/kernel/git/tomo/tgt.git;a=commit;h=107d922706cd36f3bb79bcca9bc4678c32f22e59

External Source: CONFIRM

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574935

Type: Patch Information

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=574935

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=576359

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=576359

External Source: XF

Name: lstf-isns-format-string(57496)

Hyperlink:http://xforce.iss.net/xforce/xfdb/57496

External Source: VUPEN

Name: ADV-2010-1786

Hyperlink:http://www.vupen.com/english/advisories/2010/1786

External Source: BID

Name: 39127

Hyperlink:http://www.securityfocus.com/bid/39127

External Source: MANDRIVA

Name: MDVSA-2010:131

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2010:131

External Source: DEBIAN

Name: DSA-2042

Hyperlink:http://www.debian.org/security/2010/dsa-2042

External Source: SECUNIA

Name: 39726

Hyperlink:http://secunia.com/advisories/39726

External Source: SECUNIA

Name: 39142

Type: Advisory

Hyperlink:http://secunia.com/advisories/39142

External Source: OVAL

Name: oval:org.mitre.oval:def:11248

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:11248

External Source: MLIST

Name: [oss-security] 20100331 iscsitarget/scsi-target-tuils format string CVE assignment

Hyperlink:http://marc.info/?l=oss-security&m=127005132403189&w=2

External Source: SUSE

Name: SUSE-SR:2010:017

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html

References to Check Content

Identifier:oval:org.mitre.oval:def:11248

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:11248