According to the version of the open-iscsi package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in uIP 1.0, as used in Contiki     3.0 and other products. The code that reassembles     fragmented packets fails to properly validate the total     length of an incoming packet specified in its IP     header, as well as the fragmentation offset value     specified in the IP header. By crafting a packet with     specific values of the IP header length and the     fragmentation offset, attackers can write into the .bss     section of the program (past the statically allocated     buffer that is used for storing the fragmented data)     and cause a denial of service in uip_reass() in uip.c,     or possibly execute arbitrary code on some target     architectures.(CVE-2020-17438)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the open-iscsi package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - An issue was discovered in uIP 1.0, as used in Contiki     3.0 and other products. The code that reassembles     fragmented packets fails to properly validate the total     length of an incoming packet specified in its IP     header, as well as the fragmentation offset value     specified in the IP header. By crafting a packet with     specific values of the IP header length and the     fragmentation offset, attackers can write into the .bss     section of the program (past the statically allocated     buffer that is used for storing the fragmented data)     and cause a denial of service in uip_reass() in uip.c,     or possibly execute arbitrary code on some target     architectures.(CVE-2020-17438)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

このopen-iscsi用の更新プログラムでは、次の問題が修正されています:

CVE-2020-17437: uIP 領域外書き込み (bsc#1179908)

CVE-2020-17438: uIP 領域外書き込み (bsc#1179908)

CVE-2020-13987: uIP 境界外読み取り (bsc#1179908)

CVE-2020-13988: uIP 整数オーバーフロー (bsc#1179908)

iscsi ログインサービスの no-wait (「-W」) iscsiadm オプションを有効化します (bsc#1173886、bsc#1183421)

非同期ログインを実行する機能を追加しました (bsc#1173886)

注: Tenable Network Security は、前述の記述ブロックを SUSE セキュリティアドバイザリから直接抽出しています。Tenable では、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

このopen-iscsi用の更新プログラムでは、次の問題が修正されています：

CVE-2019-17437、CVE-2020-17438、CVE-2020-13987、およびCVE-2020-13988に対する修正（bsc#1179908）：

フレームの終端を越えたTCP緊急ポインターをチェックします

TCPオプションを処理する際にu8オーバーフローをチェックします

チェックサム計算中のヘッダー長のアンダーフローをチェックします

注意：Tenable Network Securityは、前述の記述ブロックをSUSEセキュリティアドバイザリから直接抽出しています。Tenableでは、そこに新しい問題を追加することはせずに、できる限り自動的に整理と書式設定をするようにしています。

This update for open-iscsi fixes the following issues :

Fixes for CVE-2019-17437, CVE-2020-17438, CVE-2020-13987 and CVE-2020-13988 (bsc#1179908) :

check for TCP urgent pointer past end of frame

check for u8 overflow when processing TCP options

check for header length underflow during checksum calculation

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for open-iscsi fixes the following issues :

CVE-2020-17437: uIP Out-of-Bounds Write (bsc#1179908)

CVE-2020-17438: uIP Out-of-Bounds Write (bsc#1179908)

CVE-2020-13987: uIP Out-of-Bounds Read (bsc#1179908)

CVE-2020-13988: uIP Integer Overflow (bsc#1179908)

Enabled no-wait ('-W') iscsiadm option for iscsi login service (bsc#1173886, bsc#1183421)

Added the ability to perform async logins (bsc#1173886)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
148640	EulerOS Virtualization 2.9.0 : open-iscsi (EulerOS-SA-2021-1762)	Nessus	Huawei Local Security Checks	2021/4/15	2024/1/4	critical
150224	EulerOS 2.0 SP9 : open-iscsi (EulerOS-SA-2021-1932)	Nessus	Huawei Local Security Checks	2021/6/3	2023/12/27	critical
148504	SUSE SLES15セキュリティ更新プログラム: open-iscsi(SUSE-SU-2021:1164-1)	Nessus	SuSE Local Security Checks	2021/4/14	2024/1/4	critical
146944	SUSE SLES12セキュリティ更新プログラム：open-iscsi（SUSE-SU-2021:0663-1）	Nessus	SuSE Local Security Checks	2021/3/2	2024/1/18	critical
150209	EulerOS 2.0 SP9 : open-iscsi (EulerOS-SA-2021-1953)	Nessus	Huawei Local Security Checks	2021/6/3	2023/12/27	critical
146944	SUSE SLES12 Security Update : open-iscsi (SUSE-SU-2021:0663-1)	Nessus	SuSE Local Security Checks	2021/3/2	2024/1/18	critical
148620	EulerOS Virtualization 2.9.1 : open-iscsi (EulerOS-SA-2021-1718)	Nessus	Huawei Local Security Checks	2021/4/15	2024/1/4	critical
148504	SUSE SLES15 Security Update : open-iscsi (SUSE-SU-2021:1164-1)	Nessus	SuSE Local Security Checks	2021/4/14	2024/1/4	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical

critical