usr/mgmt_ipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AF_LOCAL socket instead of the new connection, which allows remote attackers to access the management interface and cause a denial of service (iscsid exit or iSCSI connection loss).

From Red Hat Security Advisory 2007:0497 :

Updated iscsi-initiator-utils packages that fix a security flaw in open-iscsi are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The iscsi package provides the server daemon for the iSCSI protocol, as well as the utility programs used to manage it. iSCSI is a protocol for distributed disk access using SCSI commands sent over Internet Protocol networks.

Olaf Kirch discovered two flaws in open-iscsi. A local attacker could use these flaws to cause the server daemon to stop responding, leading to a denial of service. (CVE-2007-3099, CVE-2007-3100).

All users of open-iscsi should upgrade to this updated package which resolves these issues.

Note: This issue did not affect Red Hat Enterprise Linux 2.1, 3, or 4.
open-iscsi is available in Red Hat Enterprise Linux 5 as a Technology Preview.

Olaf Kirch discovered two flaws in open-iscsi. A local attacker could use these flaws to cause the server daemon to stop responding, leading to a denial of service. (CVE-2007-3099, CVE-2007-3100).

Updated iscsi-initiator-utils packages that fix a security flaw in open-iscsi are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

The iscsi package provides the server daemon for the iSCSI protocol, as well as the utility programs used to manage it. iSCSI is a protocol for distributed disk access using SCSI commands sent over Internet Protocol networks.

Olaf Kirch discovered two flaws in open-iscsi. A local attacker could use these flaws to cause the server daemon to stop responding, leading to a denial of service. (CVE-2007-3099, CVE-2007-3100).

All users of open-iscsi should upgrade to this updated package which resolves these issues.

Note: This issue did not affect Red Hat Enterprise Linux 2.1, 3, or 4.
open-iscsi is available in Red Hat Enterprise Linux 5 as a Technology Preview.

This update fixes some possible vulnerabilities in the open-iscsi daemon. (CVE-2007-3099 / CVE-2007-3100)

This update to iscsi-initiator-utils is a rebase to the upstream open-iscsi-2.0-865 release. This release include two security fixes, bug fixes and new features.

The tools in this release use a different db format, but the tools are able to read old and new formats. If you want to use the new features you must update the db, by rediscovering your targets and reconfiguring them (set per target CHAP, iscsi.node, iscsi.conn, etc settings again). Once the db has been updated you cannot use older tools on it.

See the README and man pages for information on the new features.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes insecure privileges and credential verification with the iscsi daemon. (CVE-2007-3099, CVE-2007-3100)

Several local and remote vulnerabilities have been discovered in open-iscsi, a transport-independent iSCSI implementation. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-3099     Olaf Kirch discovered that due to a programming error     access to the management interface socket was     insufficiently protected, which allows denial of     service.

  - CVE-2007-3100     Olaf Kirch discovered that access to a semaphore used in     the logging code was insufficiently protected, allowing     denial of service.

The oldstable distribution (sarge) doesn't include open-iscsi.

ID	Name	Product	Family	Severity
67523	Oracle Linux 5 : iscsi-initiator-utils (ELSA-2007-0497)	Nessus	Oracle Linux Local Security Checks	low
60208	Scientific Linux Security Update : iscsi-initiator-utils on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	low
43643	CentOS 5 : iscsi-initiator-utils (CESA-2007:0497)	Nessus	CentOS Local Security Checks	low
29533	SuSE 10 Security Update : open-iscsi (ZYPP Patch Number 4035)	Nessus	SuSE Local Security Checks	low
27669	Fedora 7 : iscsi-initiator-utils-6.2.0.865-0.0.fc7 (2007-0543)	Nessus	Fedora Local Security Checks	low
27362	openSUSE 10 Security Update : open-iscsi (open-iscsi-4034)	Nessus	SuSE Local Security Checks	low
25558	Debian DSA-1314-1 : open-iscsi - several vulnerabilities	Nessus	Debian Local Security Checks	low
25523	RHEL 5 : iscsi-initiator-utils (RHSA-2007:0497)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2007-3099

high

Tenable Plugins

low

low

low

low

low

low

low

low