saned in sane-backends 1.0.7 and earlier does not properly "check the validity of the RPC numbers it gets before getting the parameters," with unknown consequences.

Alexander Hvostov, Julien Blache and Aurelien Jarno discovered several security-related problems in the sane-backends package, which contains an API library for scanners including a scanning daemon (in the package libsane) that can be remotely exploited. These problems allow a remote attacker to cause a segmentation fault and/or consume arbitrary amounts of memory. The attack is successful, even if the attacker's computer isn't listed in saned.conf.

You are only vulnerable if you actually run saned e.g. in xinetd or inetd. If the entries in the configuration file of xinetd or inetd respectively are commented out or do not exist, you are safe.

Try 'telnet localhost 6566' on the server that may run saned. If you get 'connection refused' saned is not running and you are safe.

The Common Vulnerabilities and Exposures project identifies the following problems :

  - CAN-2003-0773 :
    saned checks the identity (IP address) of the remote     host only after the first communication took place     (SANE_NET_INIT). So everyone can send that RPC, even if     the remote host is not allowed to scan (not listed in     saned.conf).

  - CAN-2003-0774 :

    saned lacks error checking nearly everywhere in the     code. So connection drops are detected very late. If the     drop of the connection isn't detected, the access to the     internal wire buffer leaves the limits of the allocated     memory. So random memory 'after' the wire buffer is read     which will be followed by a segmentation fault.

  - CAN-2003-0775 :

    If saned expects strings, it mallocs the memory     necessary to store the complete string after it receives     the size of the string. If the connection was dropped     before transmitting the size, malloc will reserve an     arbitrary size of memory. Depending on that size and the     amount of memory available either malloc fails (->saned     quits nicely) or a huge amount of memory is allocated.
    Swapping and OOM measures may occur depending on the     kernel.

  - CAN-2003-0776 :

    saned doesn't check the validity of the RPC numbers it     gets before getting the parameters.

  - CAN-2003-0777 :

    If debug messages are enabled and a connection is     dropped, non-null-terminated strings may be printed and     segmentation faults may occur.

  - CAN-2003-0778 :

    It's possible to allocate an arbitrary amount of memory     on the server running saned even if the connection isn't     dropped. At the moment this cannot easily be fixed     according to the author. Better limit the total amount     of memory saned may use (ulimit).

Several vulnerabilities were discovered in the saned daemon, a part of the sane package, which allows for a scanner to be used remotely. The IP address of the remote host is only checked after the first communication occurs, which causes the saned.conf restrictions to be ignored for the first connection. As well, a connection that is dropped early can cause Denial of Service issues due to a number of differing factors. Finally, a lack of error checking can cause various other unfavourable actions.

The provided packages have been patched to correct the issues. sane, as distributed in Mandrake Linux 9.1 and higher, have versions where the fixes were applied upstream.

The remote host is missing the patch for the advisory SuSE-SA:2003:046 (sane).


The sane (Scanner Access Now Easy) package provides access to scanners either locally or remotely over the network.

Several bugs in sane were fixed to avoid remote denial-of-service attacks. These attacks can even be executed if the remote attacker is not allowed to access the sane server by not listing the attackers IP in the file sane.conf.
Per default saned only accepts local requests.

As a temporary workaround saned can be started via xinetd or inetd in conjunction with tcpwrapper to restrict remote access.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated SANE packages that resolve a number of vulnerabilities with the saned daemon are now available.

SANE is a package for using document scanners.

Sane includes a daemon program (called saned) that enables a single machine connected to a scanner to be used remotely. This program contains several vulnerabilities.

NOTE: Although the SANE packages include this program, it is not used by default under Red Hat Enterprise Linux.

The IP address of the remote host is only checked after the first communication occurs, causing saned.conf restrictions to be ineffective for the first communication. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0773 to this issue.

A connection that is dropped early causes one of several problems. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2003-0774, CVE-2003-0775, and CVE-2003-0777 to these issues.

Lack of error checking can cause various other unfavorable consequences. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2003-0776 and CVE-2003-0778 to these issues.

Users of SANE (particularly those that use saned for remote scanner access) should upgrade to these errata packages, which contain a backported security patch to resolve these issues.

ID	Name	Product	Family	Severity
15216	Debian DSA-379-1 : sane-backends - several vulnerabilities	Nessus	Debian Local Security Checks	high
14081	Mandrake Linux Security Advisory : sane (MDKSA-2003:099)	Nessus	Mandriva Local Security Checks	high
13814	SuSE-SA:2003:046: sane	Nessus	SuSE Local Security Checks	high
12423	RHEL 2.1 : sane-backends (RHSA-2003:285)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2003-0776

critical

Tenable Plugins

high

high

high

high