PT-2020-6871 · Open Iscsi+6 · Targetcli-Fb+6

Carnil · Published 2020-05-29 · Updated 2024-06-15 · CVE-2020-13867

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Open-iSCSI targetcli-fb versions 2.1.52 and earlier

Description The issue is related to weak permissions for the /etc/target directory, as well as the backup directory and backup files. This weakness can be exploited to gain access to confidential data.

Recommendations For Open-iSCSI targetcli-fb versions 2.1.52 and earlier, consider restricting access to the /etc/target directory and its backup files to minimize the risk of exploitation. As a temporary workaround, review and adjust the permissions of the /etc/target directory and its contents until a patch is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2023-02642

CESA-2020_4697

CESA-2020_5434

CVE-2020-13867

MGASA-2020-0326

OESA-2022-1804

OESA-2022-1805

OPENSUSE-SU-2020:1141-1

OPENSUSE-SU-2020:1144-1

OPENSUSE-SU-2020_1141-1

OPENSUSE-SU-2020_1144-1

OPENSUSE-SU-2024:11423-1

RHSA-2020:4697

RHSA-2020:5434

RHSA-2020_4697

RHSA-2020_5434

SUSE-SU-2020:2086-1

SUSE-SU-2020:2101-1

SUSE-SU-2020:2360-1

SUSE-SU-2020_2086-1

SUSE-SU-2020_2101-1

SUSE-SU-2020_2360-1

USN-4871-1

Affected Products

Astra Linux

Centos

Linuxmint

Red Hat

Suse

Ubuntu

Targetcli-Fb

References · 43

• https://osv.dev/vulnerability/openSUSE-SU-2024:11423-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02642 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2020:2086-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10699 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00005.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0326 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4871-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/653136 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6LANBGRCCZBPKKBD5ZMJS7C7DYAHYR6B · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-13867 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-13867 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-13867 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-5434.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1804 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-13867 · Security Note