Hi.
There is a security bug in 'open-iscsi'.

This information is from 'vendor-sec'.

This bug is NOT PUBLIC.

The coordinated release date (CRD) is: 2009-08-11

More information can be found here:
	https://launchpad/bugs/408915


Original posting:


----- Forwarded message from Kees Cook <kees@ubuntu.com> -----

Date: Wed, 5 Aug 2009 08:10:10 -0700
From: Kees Cook <kees@ubuntu.com>
To: Dan Bar Dov <danb@voltaire.com>
Cc: vendor-sec@lst.de, Colin Watson <cjwatson@canonical.com>
Subject: [vendor-sec] Embargoed security issue in open-iscsi
Errors-To: vendor-sec-admin@lst.de

Hi,

A private security bug was reported against open-iscsi in Ubuntu. You
are being emailed as the upstream contact. Please keep vendor-sec[1]
CC'd for any updates on this issue.

This issue is embargoed and has not been disclosed publicly. We are
requesting a coordinated release date (CRD) of 2009-08-11 14:00 UTC. We
ask that you keep this issue embargoed until the CRD[2]. If you or
members of vendor-sec do not request another date, Ubuntu will make this
bug public on the CRD.

Colin Watson reported the following bug:
https://launchpad/bugs/408915

  The iscsi_discovery shell script, typically run as root, contains the
  following code:

        df=/tmp/discovered.$$

        dbg "starting discovery to $ip"
        iscsiadm -m discovery --type sendtargets --portal ${ip}:${port} > ${df}

  This is a standard security vulnerability and should be replaced by use of
  mktemp or shell variables.

The proposed patch is attached.

Thanks in advance for your cooperation in coordinating a fix for this issue,

-Kees

[1] vendor-sec is a private mailing list for distributors of operating systems
    to collaborate on security vulnerabilities and coordinate security updates.
    Discussions on vendor-sec are considered private and should not be made
    public, though the result of the discussions may be made public after the
    coordinated release date.
[2] Please do not release a fix, make public revision control commits, comment
    in public bug reports or otherwise disclose information about this issue
    until the coordinated release date. This gives all affected parties a
    chance to release a fix at the same time.

-- 
Kees Cook
Ubuntu Security Team

diff -u open-iscsi-2.0.870.1/utils/iscsi_discovery open-iscsi-2.0.870.1/utils/iscsi_discovery
--- open-iscsi-2.0.870.1/utils/iscsi_discovery
+++ open-iscsi-2.0.870.1/utils/iscsi_discovery
@@ -128,24 +128,22 @@
 
 	connected=0
 	discovered=0
-	df=/tmp/discovered.$$
 
 	dbg "starting discovery to $ip"
-	iscsiadm -m discovery --type sendtargets --portal ${ip}:${port} > ${df}
-	while read portal target
+	disc="$(iscsiadm -m discovery --type sendtargets --portal ${ip}:${port})"
+	echo "${disc}" | while read portal target
 	do
 		portal=${portal%,*}
 		select_transport
-	done < ${df}
+	done
 
-	discovered=$(cat ${df} | wc -l)
+	discovered=$(echo "${disc}" | wc -l)
 	if [ ${discovered} = 0 ]; then
 		echo "failed to discover targets at ${ip}"
 		exit 2
 	else
 		echo "discovered ${discovered} targets at ${ip}"
 	fi
-	/bin/rm -f ${df}
 }
 
 try_login()


----- End forwarded message -----

-- 
Bye,
     Thomas
-- 
 Thomas Biege <thomas@suse.de>, SUSE LINUX, Security Support & Auditing
 SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
-- 
           Hamming's Motto:
           The purpose of computing is insight, not numbers.
                                -- Richard W. Hamming