Bug 243719 (CVE-2007-3099, CVE-2007-3100) - CVE-2007-3099 dos flaws in open-iscsi (CVE-2007-3100)
Summary: CVE-2007-3099 dos flaws in open-iscsi (CVE-2007-3100)
Alias: CVE-2007-3099, CVE-2007-3100
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: reported=20070601,public=20070611,sou...
Depends On: 243726 243727
TreeView+ depends on / blocked
Reported: 2007-06-11 14:56 UTC by Mark J. Cox
Modified: 2018-08-15 23:42 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-01-15 16:56:22 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
cve-2007-3099 patch (909 bytes, patch)
2007-06-11 15:03 UTC, Mark J. Cox
no flags Details | Diff
cve-2007-3100 patch (477 bytes, patch)
2007-06-11 15:04 UTC, Mark J. Cox
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0497 normal SHIPPED_LIVE Moderate: iscsi-initiator-utils security update 2007-06-14 09:57:16 UTC

Comment 1 Mark J. Cox 2007-06-11 14:59:26 UTC
Olaf Kirch from Oracle found two issues in open-iscsi

 1)     iscsid provides a management interface using an AF_LOCAL
        socket. To prevent unauthorized users from messing with it, it
        checks for the client's uid by doing a getsockopt(SO_PEERCRED).

        Unfortunately, it performs this operation on the *listening* socket,
        rather than the newly accepted connection. This will always return
        a uid of 0, effectively allowing everyone to perform management
        operations on the iSCSI initiator.

        It currently appears as if the impact is limited to DoS, as there's
        no obvious way for an attacker to retrieve eg passwords, or
        gain privilege. There's a whole lot of code though, so maybe
        there's a buffer overflow lurking somewhere that can be exploited.

        However, at a minimum this allows an attacker to shoot down iscsid,
        or tear down individual iSCSI connections.


 2)     iscsid uses a rather fanciful logging mechanism, where
        the main process logs to a shared memory area, from
        where a child process picks up the messages and feeds
        them to syslog. This is protected by a semaphore created
        with mode 0666. This allows anyone to up the semaphore.
        iscsid will block on the next attempt to log something, and
        hang indefinitely.


Should be public later today, marking as embargoed for now.

Comment 2 Mark J. Cox 2007-06-11 15:03:43 UTC
Created attachment 156720 [details]
cve-2007-3099 patch

Comment 3 Mark J. Cox 2007-06-11 15:04:01 UTC
Created attachment 156721 [details]
cve-2007-3100 patch

Comment 4 Mark J. Cox 2007-06-11 21:10:12 UTC
now public, removing embargo

Comment 6 Red Hat Product Security 2008-01-15 16:56:22 UTC
This issue was addressed in:

Red Hat Enterprise Linux:


Note You need to log in before you can comment on or make changes to this bug.