An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to     abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of     checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code     execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the     payload length before a write operation. (CVE-2017-17840)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to the versions of the iscsi-initiator-utils packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to     abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of     checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code     execution. The process_iscsid_broadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the     payload length before a write operation. (CVE-2017-17840)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the iscsi-initiator-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in Open-iSCSI through 2.0.875.
    A local attacker can cause the iscsiuio server to abort     or potentially execute code by sending messages with     incorrect lengths, which (due to lack of checking) can     lead to buffer overflows, and result in aborts (with     overflow checking enabled) or code execution. The     process_iscsid_broadcast function in     iscsiuio/src/unix/iscsid_ipc.c does not validate the     payload length before a write     operation.(CVE-2017-17840)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
221173	Linux Distros Unpatched Vulnerability : CVE-2017-17840	Nessus	Misc.	high
188663	EulerOS Virtualization 3.0.6.6 : iscsi-initiator-utils (EulerOS-SA-2023-3399)	Nessus	Huawei Local Security Checks	high
132131	EulerOS 2.0 SP3 : iscsi-initiator-utils (EulerOS-SA-2019-2596)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2017-17840

high

Tenable Plugins

high

high

high