Ubuntu Security Notice USN-6259-1 ≈ Packet Storm

Home ^[1] Files ^[2] News ^[3] &[SERVICES_TAB] Contact ^[4] Add New ^[5]

Ubuntu Security Notice USN-6259-1^[6]: Authored by Ubuntu ^[7] | Site security.ubuntu.com ^[8]; Ubuntu Security Notice 6259-1 - Jos Wetzels, Stanislav Dashevskyi, and Amine Amri discovered that Open-iSCSI incorrectly handled certain checksums for IP packets. An attacker could possibly use this issue to expose sensitive information. Jos Wetzels, Stanislav Dashevskyi, Amine Amri discovered that Open-iSCSI incorrectly handled certain parsing TCP MSS options. An attacker could possibly use this issue to cause a crash or cause unexpected behavior.; systems | linux ^[9], ubuntu ^[10]; advisories | CVE-2020-13987 ^[11], CVE-2020-13988 ^[12], CVE-2020-17437 ^[13]; SHA-256 | 11add8b04ad913d8a0d55bdb51820f2c3df6cc99cc46d3fb35aa47446b9c769f; Download ^[14] | Favorite ^[15] | View ^[16]

        =========================================================================
Ubuntu Security Notice USN-6259-1
July 27, 2023
open-iscsi vulnerabilities
=========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
Several security issues were fixed in Open-iSCSI.
Software Description:
- open-iscsi: Open Source iSCSI implementation
Details:
Jos Wetzels, Stanislav Dashevskyi, and Amine Amri discovered that
Open-iSCSI incorrectly handled certain checksums for IP packets.
An attacker could possibly use this issue to expose sensitive information.
(CVE-2020-13987)
Jos Wetzels, Stanislav Dashevskyi, Amine Amri discovered that
Open-iSCSI incorrectly handled certain parsing TCP MSS options.
An attacker could possibly use this issue to cause a crash or cause
unexpected behavior. (CVE-2020-13988)
Amine Amri and Stanislav Dashevskyi discovered that Open-iSCSI
incorrectly handled certain TCP data. An attacker could possibly
use this issue to expose sensitive information. (CVE-2020-17437)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
open-iscsi                      2.0.874-7.1ubuntu6.4
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
open-iscsi                      2.0.874-5ubuntu2.11+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
open-iscsi                      2.0.873+git0.3b4b4500-14ubuntu3.7+esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6259-1
CVE-2020-13987, CVE-2020-13988, CVE-2020-17437
Package Information:
https://launchpad.net/ubuntu/+source/open-iscsi/2.0.874-7.1ubuntu6.4