UBUNTU-CVE-2017-17840

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2017-17840
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17840.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-17840
Related
Published
2017-12-27T17:08:00Z
Modified
2025-01-13T10:21:30Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Open-iSCSI through 2.0.875. A local attacker can cause the iscsiuio server to abort or potentially execute code by sending messages with incorrect lengths, which (due to lack of checking) can lead to buffer overflows, and result in aborts (with overflow checking enabled) or code execution. The processiscsidbroadcast function in iscsiuio/src/unix/iscsid_ipc.c does not validate the payload length before a write operation.

References

Affected packages

Ubuntu:18.04:LTS / open-iscsi

Package

Name
open-iscsi
Purl
pkg:deb/ubuntu/open-iscsi@2.0.874-5ubuntu2.3?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.0.874-5ubuntu2.3

Affected versions

2.*

2.0.874-4ubuntu3
2.0.874-4ubuntu4
2.0.874-4ubuntu5
2.0.874-5ubuntu1
2.0.874-5ubuntu2
2.0.874-5ubuntu2.1
2.0.874-5ubuntu2.2

Ecosystem specific 

{
    "availability": "No subscription required",
    "ubuntu_priority": "medium",
    "binaries": [
        {
            "binary_name": "iscsiuio",
            "binary_version": "2.0.874-5ubuntu2.3"
        },
        {
            "binary_name": "iscsiuio-dbgsym",
            "binary_version": "2.0.874-5ubuntu2.3"
        },
        {
            "binary_name": "open-iscsi",
            "binary_version": "2.0.874-5ubuntu2.3"
        },
        {
            "binary_name": "open-iscsi-dbgsym",
            "binary_version": "2.0.874-5ubuntu2.3"
        },
        {
            "binary_name": "open-iscsi-udeb",
            "binary_version": "2.0.874-5ubuntu2.3"
        }
    ]
}