SB2020083102 - Gentoo update for targetcli-fb

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2020-10699)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper privilege management the socket used by targetclid was world-writable. A local user can use this flaw to modify the iSCSI configuration and gain elevated privileges on the target system. 

2) Incorrect default permissions (CVE-ID: CVE-2020-13867)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for /etc/target (and for the backup directory and backup files). A remote attacker can view contents of files and directories or modify them.

Remediation

Install update from vendor's website.

References

• https://security.gentoo.org/
• https://security.gentoo.org/glsa/202008-22