| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
| AI_ONLY_REPORT
package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10
------
Summary: Stack Buffer Overflow in idbm_recinfo_config via Malicious iSCSI
Target: a crafted SendTargets TargetName can inject an extra configuration
line into a persisted node record and later cause a stack buffer overflow
when that record is reparsed.
Requirements to exploit: An attacker must control an iSCSI target or tamper
with SendTargets discovery traffic, return a crafted `TargetName`
containing a newline and oversized injected key or value data, have the
victim run persistent discovery, and then trigger a later node-record read
such as update or login.
Component affected: `iscsi-initiator-utils`;
`usr/idbm.c:idbm_recinfo_config`, with attacker-controlled input reaching
it through SendTargets handling in `usr/discovery.c` and later record
serialization in `usr/idbm.c`.
Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10`
Patch available: no released package fix established; proposed patch
included below
Version fixed: unknown
Upstream coordination: Not notified.
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H - 7.5 (HIGH)
AV:N - The attacker can supply the malicious data over the network in a
SendTargets discovery response.
AC:L - The target-name length cap still leaves enough room for a newline
plus an overlong injected key; no race or unusual memory state is required.
PR:N - No prior access to the initiator is required.
UI:R - The victim must run SendTargets discovery that persists records
and later read the saved record.
S:U - The impact remains within the initiator-side component that parses
and stores its own database records.
C:L - Memory corruption could expose limited process memory, but
confidentiality impact is not demonstrated.
I:L - Process memory corruption can affect integrity, but reliable code
execution is not established.
A:H - The clearest supported outcome is a crash during config parsing.
Impact: Moderate. This issue could otherwise resemble an Important remote
denial-of-service flaw, but Red Hat rates such issues lower when they are
less easily exploited or depend on narrower conditions. Here, exploitation
requires a multi-step SendTargets discovery workflow, persistence of the
discovered record, and a later reread of that record. The strongest
supported outcome is denial of service or other memory corruption, while
code execution remains unproven.
Embargo: no
Reason: The available evidence supports a multi-step,
configuration-dependent denial-of-service or memory-corruption issue rather
than a demonstrated remote code execution flaw, so embargoed handling does
not appear necessary.
Acknowledgement: Aisle Research
Vulnerability Details: `idbm_recinfo_config()` copies config keys and
values into fixed stack buffers without bounds checks:
```c
while (*nl && !isspace(c = *nl) && *nl != '=') {
*(name+i) = *nl; i+; nl+;
}
...
while (*nl) {
*(value+i) = *nl; i+; nl+;
}
```
In this code path, `name` and `value` are 128-byte and 256-byte stack
buffers, so an injected key longer than 128 bytes or a value longer than
256 bytes can corrupt stack memory.
During SendTargets discovery, attacker-controlled `TargetName` text is
copied into the node record and later written back to disk without
control-character filtering:
```c
strlcpy(rec->name, targetname, TARGET_NAME_MAXLEN);
...
if (strlen(info[i].value))
fprintf(f, "%s = %s\n", info[i].name, info[i].value);
```
`process_sendtargets_response()` treats `TargetName=` records as discovery
input, and `add_target_record()` accepts names up to `TARGET_NAME_MAXLEN`.
That limit is 255 bytes in this package, which is still enough to carry a
newline plus a key longer than the 128-byte `name` buffer. A `TargetName`
such as `iqn.test\nAAAA...=B` can therefore split the serialized
`node.name` entry into two lines and inject a second config line.
Persistent SendTargets discovery stores discovered node records unless
nonpersistent mode is used, and later discovery update/login or explicit
node operations reread those saved records. The 2048-byte line buffer in
`idbm_recinfo_config()` does not prevent this because the injected line
only needs to exceed 128 bytes for the key or 256 bytes for the value.
Based on the available evidence, the supported impact is a crash or other
memory corruption during reparsing. Reliable code execution is plausible
but not established.
Steps to reproduce:
1. Run a malicious SendTargets responder, or intercept discovery traffic,
and return a `TargetName` value containing a newline and an oversized
injected key, for example `TargetName=iqn.test\nAAAAAAAA...(>=129 chars)=B`.
2. Run SendTargets discovery in its normal persistent mode. The default
`iscsiadm -m discovery ...` workflow persists records unless nonpersistent
mode is selected.
3. Inspect the saved node record and confirm that it contains both the
expected `node.name = ...` line and an injected `AAAA...=B` line.
4. Trigger any operation that rereads the node record, such as discovery
update, node update, or login.
5. Observe a crash during parsing. With instrumentation enabled, the
overflow should be reported in `idbm_recinfo_config()`.
Mitigation: Until a fix is available, avoid persistent SendTargets
discovery against untrusted or interceptable networks. Where operationally
acceptable, use nonpersistent discovery, and remove node records created
from untrusted discovery results before later update or login operations.
Proposed Fix: The fix should address both parts of the chain: bound the key
and value copies in `idbm_recinfo_config()` and reject control characters
in `TargetName` before persistence.
```diff
diff --git a/usr/idbm.c b/usr/idbm.c
@@ void idbm_recinfo_config(recinfo_t *info, FILE *f)
while (*nl && !isspace(c = *nl) && *nl != '=') {
*(name+i) = *nl; i+; nl+;
}
+ while (*nl && !isspace(c = *nl) && *nl != '=') {
+ if (i >= NAME_MAXVAL - 1) {
+ log_warning("Config file line %d key too long",
line_number);
+ break;
+ }
+ name[i++] = *nl++;
+ }
@@
while (*nl) {
*(value+i) = *nl; i+; nl+;
}
+ while (*nl) {
+ if (i >= VALUE_MAXVAL - 1) {
+ log_warning("Config file line %d value too long",
line_number);
+ break;
+ }
+ value[i++] = *nl++;
+ }
diff --git a/usr/discovery.c b/usr/discovery.c
@@ static int add_target_record(char *name, char *end, discovery_rec_t
*drec,
while ((nul < end) && (*nul != '\0'))
nul++;
+ for (char *p = name; p < nul; p++) {
+ if (*p == '\n' || *p == '\r' || (unsigned char)*p < 0x20) {
+ log_error("TargetName contains control characters,
rejecting");
+ return 0;
+ }
+ }
```
------
This report was generated using AI technology. Always review AI-generated
content prior to use |
| A flaw has been found in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected by this vulnerability is the function setParentalRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Executing a manipulation of the argument urlKeyword can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been published and may be used. |
| A security vulnerability has been detected in TOTOLINK A800R 4.1.2cu.5137_B20200730. This impacts the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. Such manipulation of the argument Comment leads to stack-based buffer overflow. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. |
| A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. The impacted element is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi of the component firewall.so. The manipulation of the argument Comment results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. |
| A vulnerability was found in Tenda AC1206 15.03.06.23_multi_TD01. This affects the function set_device_name of the file /goform/SetOnlineDevName of the component httpd web management interface. The manipulation of the argument devName results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. |
| A vulnerability was identified in Tenda G0 up to 20260625. This issue affects the function formSetPortMirror of the file /goform/module of the component httpd Web Management Interface. Such manipulation of the argument portMirrorMirroredPorts leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. |
| A stack buffer overflow vulnerability was found in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is printed into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN that exceeds the buffer, causing a stack buffer overflow and process crash, resulting in denial of service. |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| Stack-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges locally. |
| Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. |
| Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Stack-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to execute code over a network. |
| Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service |
| A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog. |
| IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. |
