CVE-2010-0743 Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 al...
MediumCVSS 5.0
EPSS 3.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zaal tgt | <= 0.9.5 | No fix listed |
| zaal tgt | = 1.0.3 | No fix listed |
| iscsitarget | = 0.4.16 | No fix listed |
| debian/tgt(Debian:12) | < 1:1.0.3-2 | 1:1.0.3-2 |
| debian/tgt(Debian:13) | < 1:1.0.3-2 | 1:1.0.3-2 |
| debian/tgt(Debian:14) | < 1:1.0.3-2 | 1:1.0.3-2 |
References
- bugs.debian.org patch
- git.kernel.org
- SUSE-SR:2010:017 vendor-advisory
- [oss-security] 20100331 iscsitarget/scsi-target-tuils format string CVE assignment mailing-list
- 39142 third-party-advisory vendor-advisory
- 39726 third-party-advisory
- DSA-2042 vendor-advisory
- MDVSA-2010:131 vendor-advisory
- 39127 vdb-entry
- ADV-2010-1786 vdb-entry
- bugzilla.redhat.com
- lstf-isns-format-string(57496) vdb-entry
- oval:org.mitre.oval:def:11248 signature vdb-entry
- Debian Security Tracker CVE-2010-0743 vendor-advisory
- bugs.debian.org issue-tracking