PT-2003-1866 · Sane · Sane-Backends

Published 2003-09-12 · Updated 2013-08-23 · CVE-2003-0773

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: sane-backends versions 1.0.7 and earlier

Description: The issue concerns the saned component in sane-backends, which fails to verify the IP address of the connecting host during the SANE NET INIT RPC call. This oversight allows remote attackers to exploit this call even if their access is restricted in the saned.conf configuration file.

Recommendations: For versions 1.0.7 and earlier, consider restricting access to the saned service to minimize the risk of exploitation until a patch is available. As a temporary workaround, review and tighten the restrictions in the saned.conf file to limit access to trusted hosts.

Fix

Related Identifiers

CVE-2003-0773

DSA-379

Affected Products

Sane-Backends

References · 12

• http://novell.com/linux/security/advisories/2003_046_sane.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0773 · Security Note
• https://osv.dev/vulnerability/CVE-2003-0773 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2003:099 · Vendor Advisory
• http://securityfocus.com/bid/8595 · Vendor Advisory
• http://debian.org/security/2003/dsa-379 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-278.html · Vendor Advisory
• ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-005.0/CSSA-2004-005.0.txt · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2003-285.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-0773 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-0773 · Vendor Advisory
• http://securityfocus.com/bid/8593 · Note