A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enables the targetclid socket, a local attacker can use this flaw to modify the iSCSI configuration and escalate their privileges to root.

The remote Ubuntu 20.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4871-1 advisory.

    It was discovered that targetcli-fb did not properly manage socket permissions. A local attacker could use     this issue to modify the iSCSI configuration resulting in a denial of service, obtain sensitive

    information or execute arbitrary code. (CVE-2020-10699)

    It was discovered that targetcli-fb did not properly manage permissions for

    /etc/target and underneath backup directory/files. An attacker could use this issue to access sensitive     information. (CVE-2020-13867)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2020:1933 advisory.

  - targetcli: world writable /var/run/targetclid.sock allows unprivileged user to execute commands     (CVE-2020-10699)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202008-22 (targetcli-fb: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in targetcli-fb. Please       review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1933 advisory.

    [2.1.51-4]
    - Increase the release version

    [2.1.51-3]
    - targetclid.sock allows unprivileged user to execute commands

    [2.1.51-2]
    - Create the target/pr directory when installing the package

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1933 advisory.

    The targetcli package contains an administration shell for configuring Internet Small Computer System     Interface (iSCSI), Fibre Channel over Ethernet (FCoE), and other SCSI targets, using the Target Core     Mod/Linux-IO (TCM/LIO) kernel target subsystem. FCoE users also need to install and use the fcoe-utils     package.

    Security Fix(es):

    * targetcli: world writable /var/run/targetclid.sock allows unprivileged user to execute commands     (CVE-2020-10699)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
183536	Ubuntu 20.04 ESM : targetcli-fb vulnerabilities (USN-4871-1)	Nessus	Ubuntu Local Security Checks	high
145856	CentOS 8 : targetcli (CESA-2020:1933)	Nessus	CentOS Local Security Checks	high
140070	GLSA-202008-22 : targetcli-fb: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
136445	Oracle Linux 8 : targetcli (ELSA-2020-1933)	Nessus	Oracle Linux Local Security Checks	high
136065	RHEL 8 : targetcli (RHSA-2020:1933)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-10699

high

Tenable Plugins

high

high

high

high

high