(Red Hat Issues Fix) Open-iSCSI Lets Local Users Deny Service
|
|
SecurityTracker Alert ID: 1018247 |
|
SecurityTracker URL: http://securitytracker.com/id/1018247
|
|
CVE Reference:
CVE-2007-3099, CVE-2007-3100
(Links to External Site)
|
Date: Jun 14 2007
|
Impact:
Denial of service via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
|
Description:
Two vulnerabilities were reported in Open-iSCSI. A local user can cause the iSCSI server daemon to stop responding.
The iscsid does not properly validate user identities on the management interface [CVE-2007-3099]. A local user can connect to the interface and perform management operations on the iSCSI initiator, including tearing down individual connections or shut down the daemon.
A local user can set up a semaphore used by the logging mechanism to cause the daemon to hang when attempting to write to the log [CVE-2007-3100].
Olaf Kirch discovered these vulnerabilities.
|
Impact:
A local user can the target server daemon to stop responding.
|
Solution:
Red Hat has released a fix.
The Red Hat advisory is available at:
https://rhn.redhat.com/errata/RHSA-2007-0497.html
|
Vendor URL: www.open-iscsi.org/ (Links to External Site)
|
Cause:
Access control error, Authentication error
|
Underlying OS:
Linux (Red Hat Enterprise)
|
|
Message History:
This archive entry is a follow-up to the message listed below.
|
Source Message Contents
|
Date: Thu, 14 Jun 2007 06:20:55 -0400
Subject: [RHSA-2007:0497-01] Moderate: iscsi-initiator-utils security update
|
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- ---------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Moderate: iscsi-initiator-utils security update
Advisory ID: RHSA-2007:0497-01
Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0497.html
Issue date: 2007-06-14
Updated on: 2007-06-14
Product: Red Hat Enterprise Linux
Keywords: open-iscsi
CVE Names: CVE-2007-3099 CVE-2007-3100
- ---------------------------------------------------------------------
1. Summary:
Updated iscsi-initiator-utils packages that fix a security flaw in
open-iscsi are now available for Red Hat Enterprise Linux 5.
This update has been rated as having moderate security impact by the Red
Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, x86_64
3. Problem description:
The iscsi package provides the server daemon for the iSCSI protocol, as
well as the utility programs used to manage it. iSCSI is a protocol for
distributed disk access using SCSI commands sent over Internet Protocol
networks.
Olaf Kirch discovered two flaws in open-iscsi. A local attacker could use
these flaws to cause the server daemon to stop responding, leading to a
denial of service. (CVE-2007-3099, CVE-2007-3100).
All users of open-iscsi should upgrade to this updated package which
resolves these issues.
Note: This issue did not affect Red Hat Enterprise Linux 2.1, 3, or 4.
open-iscsi is available in Red Hat Enterprise Linux 5 as a Technology
Preview.
4. Solution:
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188
5. Bug IDs fixed (http://bugzilla.redhat.com/):
243719 - CVE-2007-3099 dos flaws in open-iscsi (CVE-2007-3100)
6. RPMs required:
Red Hat Enterprise Linux Desktop (v. 5 client):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm
1641a3f2f9c7c06b923bd5ae7174aafc iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm
i386:
e8241658758493f0ed6b0deb515ff2d4 iscsi-initiator-utils-6.2.0.742-0.6.el5.i386.rpm
b6dae38ce85a004fb6b1c5316472296b iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.i386.rpm
x86_64:
907981526cb8a26b6c2858fa18fb2b69 iscsi-initiator-utils-6.2.0.742-0.6.el5.x86_64.rpm
9f1158d5930b38af251ff3070bee2f4d iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm
1641a3f2f9c7c06b923bd5ae7174aafc iscsi-initiator-utils-6.2.0.742-0.6.el5.src.rpm
i386:
e8241658758493f0ed6b0deb515ff2d4 iscsi-initiator-utils-6.2.0.742-0.6.el5.i386.rpm
b6dae38ce85a004fb6b1c5316472296b iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.i386.rpm
ia64:
a579261aff181eba655d27527696ad76 iscsi-initiator-utils-6.2.0.742-0.6.el5.ia64.rpm
85e98cd7a8b8139f1dcb3602fc2bf0e3 iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.ia64.rpm
ppc:
87d4404ac8698baa64353da68164500c iscsi-initiator-utils-6.2.0.742-0.6.el5.ppc.rpm
6b949fdac71d03cbf6c59446762c3653 iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.ppc.rpm
x86_64:
907981526cb8a26b6c2858fa18fb2b69 iscsi-initiator-utils-6.2.0.742-0.6.el5.x86_64.rpm
9f1158d5930b38af251ff3070bee2f4d iscsi-initiator-utils-debuginfo-6.2.0.742-0.6.el5.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3099
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3100
http://kbase.redhat.com/faq/FAQ_105_10521.shtm
http://www.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://www.redhat.com/security/team/contact/
Copyright 2007 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)
iD4DBQFGcRaDXlSAg2UNWIIRAjY7AJdhlzRQE8FSWb8ecqr57t79AdVKAKCu9dwH
WZ6BkrIAg356I0uMqs+sdA==
=KbB7
-----END PGP SIGNATURE-----
--
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list
|
|
