Multiple buffer overflows in the iSNS implementation in isns.c in...

5 CVSS

Vulnerability Description

Multiple buffer overflows in the iSNS implementation in isns.c in (1) Linux SCSI target framework (aka tgt or scsi-target-utils) before 1.0.6, (2) iSCSI Enterprise Target (aka iscsitarget or IET) 1.4.20.1 and earlier, and (3) Generic SCSI Target Subsystem for Linux (aka SCST or iscsi-scst) 1.0.1.1 and earlier allow remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via (a) a long iSCSI Name string in an SCN message or (b) an invalid PDU.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-2221

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from zaal

View All →

CVE-2011-0001

Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the...

Medium 5

CVE-2010-0743

Multiple format string vulnerabilities in isns.c in (1) Linux SCSI...

Medium 5

Affected Vendor

zaal

View all reports →

Affected Software

tgt, iscsitarget, generic scsi target subsystem

Vulnerable Versions:

0, 0.9.5, 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 0.1.0, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 0.2.5, 0.2.6, 0.3.0, 0.3.1, 0.3.2, 0.3.3, 0.3.4, 0.3.5, 0.3.6, 0.3.7, 0.3.8, 0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4, 0.4.5, 0.4.6, 0.4.7, 0.4.8, 0.4.9, 0.4.10, 0.4.11, 0.4.12, 0.4.13, 0.4.14, 0.4.15, 0.4.16, 0.4.17, 1.4.18, 1.4.19, 0.9.0a, 0.9.1, 0.9.2, 0.9.3, 0.9.4, 0.9.5.1, 0.9.5.2

Timeline

Official Publish: July 8th, 2010

Last Modified: August 7th, 2024

Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.