Some vulnerabilities have been reported in Linux SCSI Target Framework (tgt), which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system.

The vulnerabilities are caused due to a boundary errors when processing certain iSNS (Internet Storage Name Service) messages, which can be exploited to cause buffer overflows by sending specially crafted messages.

Successful exploitation may allow the execution of arbitrary code.

This is related to:
SA40485

The vulnerabilities are reported in version 1.0.5. Prior versions may also be affected.

Solution
Update to version 1.0.6.

Provided and/or discovered by
TELUS Security Labs Vulnerability Research Team. Additional information provided by the vendor.

Original Advisory
TELUS Security Labs:
http://archives.neohapsis.com/archives/fulldisclosure/2010-07/0058.html

Linux SCSI Target Framework (tgt):
http://lists.wpkg.org/pipermail/stgt/2010-July/003858.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area