python-rtslib: weak permissions for /etc/target/saveconfig.json

A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for /etc/target/saveconfig.json because the shutil.copyfile, instead of shutil.copy is used, and permissions are not preserved upon editing. This flaw allows an attacker with prior access to...

Moderate: Red Hat Security Advisory: targetcli security and enhancement update

An update for targetcli is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

Moderate: targetcli security and enhancement update

The targetcli package contains an administration shell for configuring Internet Small Computer System Interface iSCSI, Fibre Channel over Ethernet FCoE, and other SCSI targets, using the Target Core Mod/Linux-IO TCM/LIO kernel target subsystem. FCoE users also need to install and use the fcoe-uti...

ALBA-2020:4602 iscsi-initiator-utils bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

iscsi-initiator-utils bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

EulerOS 2.0 SP5 : python-rtslib (EulerOS-SA-2020-2268)

According to the version of the python-rtslib package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile instead of shutil.copy is...

Huawei EulerOS: Security Advisory for python-rtslib (EulerOS-SA-2020-2268)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-16980

An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges. To exploit the vulnerability, an attacker would first need code execution on a victim...

Privilege escalation

An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges. To exploit the vulnerability, an attacker would first need code execution on a victim...

CVE-2020-16980 Windows iSCSI Target Service Elevation of Privilege Vulnerability

...

CVE-2020-16980

CVE-2020-16980 is an elevation-of-privilege vulnerability in the Windows iSCSI Target Service caused by improper handling of file operations. An attacker who can achieve code execution on a victim system could run a crafted application to gain elevated privileges. The entry notes the vulnerabilit...

CVE-2020-16980: Undefined Security Weakness

An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges. To exploit the vulnerability, an attacker would first need code execution on a victim...

Windows iSCSI Target Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows iSCSI Target Service improperly handles file operations. An attacker who successfully exploited this vulnerability could gain elevated privileges. To exploit the vulnerability, an attacker would first need code execution on a victim...

systemd security and bug fix update

219-78.0.1 - Backport upstream patches related to private-tmp Sushmita Bhattacharya Orabug: 31561883 - backport upstream pstore tmpfiles patch Eric DeVolder Orabug: 31414539 - udev rules: fix memory hot add and remove Orabug: 31309730 - enable and start the pstore service Orabug: 30950903 - fix t...

Arbitrary Code Execution

qemu is vulnerable to arbitrary code execution. The vulnerability exists through an out-of-bounds heap buffer access flaw caused by the way the iSCSI Block driver handles a response coming from an iSCSI server while checking the status of a Logical Address Block LBA in an iscsicoblockstatus routi...

Debian DLA-2373-1 : qemu security update

The following security issues have been found in qemu, which could potentially result in DoS and execution of arbitrary code. CVE-2020-1711 An out-of-bounds heap buffer access flaw was found in the way the iSCSI Block driver in QEMU handled a response coming from an iSCSI server while checking th...

[SECURITY] [DLA 2373-1] qemu security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2373-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA September 13, 2020 https://wiki.debian.org/LTS -...

EulerOS Virtualization for ARM 64 3.0.2.0 : python-rtslib (EulerOS-SA-2020-1983)

According to the version of the python-rtslib package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - A flaw was found in Open-iSCSI rtslib-fb through versions 2.1.72, where it has weak permissions for...

Huawei EulerOS: Security Advisory for python-rtslib (EulerOS-SA-2020-1983)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2020-0336 Updated python-rstlib packages fix security vulnerability

Open-iSCSI rtslib-fb through 2.1.72 has weak permissions for /etc/target/saveconfig.json because shutil.copyfile instead of shutil.copy is used and thus permissions are not preserved upon editing. An adversary with prior access to /etc/target/saveconfig.json could access a later version, resultin...