Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or iscsi-scst) 1.0.1.1 and earlier allow remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via (a) a long iSCSI Name string in an SCN message or (b) an invalid PDU.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade scsi-target-utils | Dec 1, 2016 | Jul 8, 2010 |
| Oracle_linux | — | Upgrade scsi-target-utils | Oct 16, 2024 | Jul 8, 2010 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 1, 2010 |
| Suse | — | Upgrade tgtUpgrade iscsitarget-kmp-defaultUpgrade iscsitarget-kmp-xenUpgrade iscsitarget-kmp-paeUpgrade iscsitarget-kmp-ppc64Upgrade iscsitarget-kmp-vmiUpgrade iscsitarget | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade tgt | Nov 8, 2024 | Jul 8, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub