PT-2016-3236 · Sane+4 · Sane-Backends+4

Kritphong Mongkhonvanit · Published 2016-12-16 · Updated 2020-11-03 · CVE-2017-6318

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions sane-backends version 1.0.25

Description The issue is related to insufficient protection of internal data in the sane-backends package. It can be exploited by a remote attacker using a specially crafted SANE NET CONTROL OPTION packet to compromise data confidentiality. This may allow the attacker to obtain sensitive memory information.

Recommendations For version 1.0.25, consider restricting access to the SANE NET CONTROL OPTION packet to minimize the risk of exploitation until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2017-1658

BDU:2018-00027

CVE-2017-6318

DLA-940-1

MGASA-2017-0208

OPENSUSE-SU-2024:11366-1

SUSE-SU-2017:0713-1

SUSE-SU-2017:0717-1

SUSE-SU-2017_0713-1

SUSE-SU-2017_0717-1

SUSE-SU-2020:3125-1

SUSE-SU-2020_3125-1

USN-4470-1

Affected Products

Alt Linux

Linuxmint

Suse

Ubuntu

Sane-Backends

References · 48

• https://ubuntu.com/security/CVE-2020-12865 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6318 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2017-03/msg00016.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6318 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6318 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20211008SE16 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12867 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12866 · Vendor Advisory
• https://usn.ubuntu.com/4470-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4470-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12864 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6318 · Security Note
• https://ubuntu.com/security/CVE-2020-12861 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:0713-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-12863 · Vendor Advisory