Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade scsi-target-utils | Dec 1, 2016 | Apr 8, 2010 |
| Debian | — | Upgrade tgt | Jul 30, 2024 | Apr 8, 2010 |
| Gentoo Linux | — | Upgrade sys-block/iscsitarget. | Oct 30, 2017 | Apr 8, 2010 |
| Oracle_linux | — | Upgrade scsi-target-utils | Oct 16, 2024 | Apr 8, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 22, 2010 |
| Suse | — | Upgrade iscsitarget-kmp-defaultUpgrade tgtUpgrade iscsitarget-kmp-ppc64Upgrade iscsitarget-kmp-xenUpgrade iscsitargetUpgrade iscsitarget-kmp-paeUpgrade iscsitarget-kmp-vmi | Feb 17, 2015 | Jun 28, 2013 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub