tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:02740-1 advisory.

    - CVE-2024-45751: Fixed CHAP authentication bypass in user-space Linux target framework (bsc#1230360)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3976 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3976-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     November 30, 2024                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : tgt     Version        : 1:1.0.80-1+deb11u1     CVE ID         : CVE-2024-45751


    An issue has been found in tgt, Linux SCSI target user-space daemon and     tools. The issue was related to using rand() without proper seed,     resulting in identical sequences of challenges.



    For Debian 11 bullseye, this problem has been fixed in version     1:1.0.80-1+deb11u1.

    We recommend that you upgrade your tgt packages.

    For the detailed security status of tgt please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/tgt

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-7024-1 advisory.

    It was discovered that tgt attempts to achieve entropy by calling rand without srand. The PRNG seed is     always 1, and thus the sequence of challenges is always identical.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
246928	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tgt (SUSE-SU-2025:02740-1)	Nessus	SuSE Local Security Checks	medium
211974	Debian dla-3976 : tgt - security update	Nessus	Debian Local Security Checks	medium
207463	Ubuntu 20.04 LTS : tgt vulnerability (USN-7024-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2024-45751

medium

Tenable Plugins

medium

medium

medium