PT-2003-1866 · Sane · Sane-Backends

Publicado 2003-09-12 · Atualizado 2013-08-23 · CVE-2003-0773

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: sane-backends versions 1.0.7 and earlier

Description: The issue concerns the saned component in sane-backends, which fails to verify the IP address of the connecting host during the SANE NET INIT RPC call. This oversight allows remote attackers to exploit this call even if their access is restricted in the saned.conf configuration file.

Recommendations: For versions 1.0.7 and earlier, consider restricting access to the saned service to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and tighten the restrictions in the saned.conf file to limit access to trusted hosts.

Correção

Identificadores relacionados

CVE-2003-0773

DSA-379

Produtos afetados

Sane-Backends

Referências · 12

• http://novell.com/linux/security/advisories/2003_046_sane.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-0773 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2003-0773 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDKSA-2003:099 · Aviso do Fabricante
• http://securityfocus.com/bid/8595 · Aviso do Fabricante
• http://debian.org/security/2003/dsa-379 · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2003-278.html · Aviso do Fabricante
• ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-005.0/CSSA-2004-005.0.txt · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2003-285.html · Aviso do Fabricante
• http://securityfocus.com/bid/8593 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0773 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2003-0773 · Aviso do Fabricante