Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login. NOTE: some of these details are obtained from third party information.

The remote Oracle Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-0332 advisory.

    [1.0.4-3.1]
    - fix the buffer overflow bug before iscsi login (CVE-2011-0001)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A double-free flaw was found in scsi-target-utils' tgtd daemon. A remote attacker could trigger this flaw by sending carefully-crafted network traffic, causing the tgtd daemon to crash. (CVE-2011-0001)

All running scsi-target-utils services must be restarted for the update to take effect.

fix double-free vulnerability leads to pre-authenticated crash

fix iscsi target outgoing user binding broken unexpectedly

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that tgt incorrectly handled long iSCSI name strings, and invalid PDUs. A remote attacker could exploit this to cause tgt to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 10.10.
(CVE-2010-2221)

Emmanuel Bouillon discovered that tgt incorrectly handled certain iSCSI logins. A remote attacker could exploit this to cause tgt to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2011-0001).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of tgt fixes multiple bugs :

  - tgtadm user unbind broken [bnc#633111]

  - iscsitarget package not supported [bnc#513934]

  - iscsitarget vs. tgt (and /etc/ietd.conf) [bnc#598927]

  - tgt fix double free() flaw [bnc#665415, CVE-2011-0001]

An updated scsi-target-utils package that fixes one security issue is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

The scsi-target-utils package contains the daemon and tools to set up and monitor SCSI targets. Currently, iSCSI software and iSER targets are supported.

A double-free flaw was found in scsi-target-utils' tgtd daemon. A remote attacker could trigger this flaw by sending carefully-crafted network traffic, causing the tgtd daemon to crash. (CVE-2011-0001)

Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for reporting this issue.

All scsi-target-utils users should upgrade to this updated package, which contains a backported patch to correct this issue. All running scsi-target-utils services must be restarted for the update to take effect.

Emmanuel Bouillon discovered a double free in tgt, the Linux SCSI target user-space tools, which could lead to denial of service.

The oldstable distribution (lenny) doesn't include tgt.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:0332 advisory.

    The scsi-target-utils package contains the daemon and tools to set up and     monitor SCSI targets. Currently, iSCSI software and iSER targets are     supported.

    A double-free flaw was found in scsi-target-utils' tgtd daemon. A remote     attacker could trigger this flaw by sending carefully-crafted network     traffic, causing the tgtd daemon to crash. (CVE-2011-0001)

    Red Hat would like to thank Emmanuel Bouillon of NATO C3 Agency for     reporting this issue.

    All scsi-target-utils users should upgrade to this updated package, which     contains a backported patch to correct this issue. All running     scsi-target-utils services must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
68223	Oracle Linux 5 / 6 : scsi-target-utils (ELSA-2011-0332)	Nessus	Oracle Linux Local Security Checks	critical
60983	Scientific Linux Security Update : scsi-target-utils on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
55559	Fedora 14 : scsi-target-utils-1.0.18-1.fc14 (2011-8930)	Nessus	Fedora Local Security Checks	medium
55546	Fedora 15 : scsi-target-utils-1.0.18-1.fc15 (2011-8890)	Nessus	Fedora Local Security Checks	medium
55283	Ubuntu 10.10 / 11.04 : tgt vulnerabilities (USN-1156-1)	Nessus	Ubuntu Local Security Checks	medium
53638	SuSE 11.1 Security Update : tgt (SAT Patch Number 4409)	Nessus	SuSE Local Security Checks	medium
53426	CentOS 5 : scsi-target-utils (CESA-2011:0332)	Nessus	CentOS Local Security Checks	medium
53259	Debian DSA-2209-1 : tgt - double free	Nessus	Debian Local Security Checks	medium
52605	RHEL 5 / 6 : scsi-target-utils (RHSA-2011:0332)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2011-0001

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

critical