CVE-2010-0743

2010-04-0817:30:00

CWE-134

redhat

web.nvd.nist.gov

cve-2010-0743

format string vulnerabilities

isns.c

linux scsi target framework

tgt

scsi-target-utils

iscsi enterprise target

iscsitarget

denial of service

tgtd daemon crash

remote attackers

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

7.4

Confidence

High

EPSS

0.658

Percentile

97.9%

JSON

Multiple format string vulnerabilities in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) 1.0.3, 0.9.5, and earlier and (2) iSCSI Enterprise Target (aka iscsitarget) 0.4.16 allow remote attackers to cause a denial of service (tgtd daemon crash) or possibly have unspecified other impact via vectors that involve the isns_attr_query and qry_rsp_handle functions, and are related to (a) client appearance and (b) client disappearance messages.

Affected configurations

Nvd

Node

zaaltgtRange≤0.9.5

zaaltgtMatch1.0.3

Node

iscsitargetiscsitargetMatch0.4.16

VendorProductVersionCPE
zaaltgt*cpe:2.3:a:zaal:tgt:*:*:*:*:*:*:*:*
zaaltgt1.0.3cpe:2.3:a:zaal:tgt:1.0.3:*:*:*:*:*:*:*
iscsitargetiscsitarget0.4.16cpe:2.3:a:iscsitarget:iscsitarget:0.4.16:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zaal	tgt	*	cpe:2.3:a:zaal:tgt::::::::
zaal	tgt	1.0.3	cpe:2.3:a:zaal:tgt:1.0.3:::::::*
iscsitarget	iscsitarget	0.4.16	cpe:2.3:a:iscsitarget:iscsitarget:0.4.16:::::::*