Bug 243719 - (CVE-2007-3099) CVE-2007-3099 dos flaws in open-iscsi (CVE-2007-3100)
CVE-2007-3099 dos flaws in open-iscsi (CVE-2007-3100)
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
Depends On: 243726 243727
  Show dependency treegraph
Reported: 2007-06-11 10:56 EDT by Mark J. Cox (Product Security)
Modified: 2008-01-15 11:56 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-01-15 11:56:22 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
cve-2007-3099 patch (909 bytes, patch)
2007-06-11 11:03 EDT, Mark J. Cox (Product Security)
no flags Details | Diff
cve-2007-3100 patch (477 bytes, patch)
2007-06-11 11:04 EDT, Mark J. Cox (Product Security)
no flags Details | Diff

  None (edit)
Comment 1 Mark J. Cox (Product Security) 2007-06-11 10:59:26 EDT
Olaf Kirch from Oracle found two issues in open-iscsi

 1)     iscsid provides a management interface using an AF_LOCAL
        socket. To prevent unauthorized users from messing with it, it
        checks for the client's uid by doing a getsockopt(SO_PEERCRED).

        Unfortunately, it performs this operation on the *listening* socket,
        rather than the newly accepted connection. This will always return
        a uid of 0, effectively allowing everyone to perform management
        operations on the iSCSI initiator.

        It currently appears as if the impact is limited to DoS, as there's
        no obvious way for an attacker to retrieve eg passwords, or
        gain privilege. There's a whole lot of code though, so maybe
        there's a buffer overflow lurking somewhere that can be exploited.

        However, at a minimum this allows an attacker to shoot down iscsid,
        or tear down individual iSCSI connections.


 2)     iscsid uses a rather fanciful logging mechanism, where
        the main process logs to a shared memory area, from
        where a child process picks up the messages and feeds
        them to syslog. This is protected by a semaphore created
        with mode 0666. This allows anyone to up the semaphore.
        iscsid will block on the next attempt to log something, and
        hang indefinitely.


Should be public later today, marking as embargoed for now.
Comment 2 Mark J. Cox (Product Security) 2007-06-11 11:03:43 EDT
Created attachment 156720 [details]
cve-2007-3099 patch
Comment 3 Mark J. Cox (Product Security) 2007-06-11 11:04:01 EDT
Created attachment 156721 [details]
cve-2007-3100 patch
Comment 4 Mark J. Cox (Product Security) 2007-06-11 17:10:12 EDT
now public, removing embargo
Comment 6 Red Hat Product Security 2008-01-15 11:56:22 EST
This issue was addressed in:

Red Hat Enterprise Linux:


Note You need to log in before you can comment on or make changes to this bug.