Solved!
Go to SolutionDell idrac openssl MITM vulnerability
Hi
We use nessus to scan our network. My most recent scan reports several openssl vulnerabilitis with a cvss score of 9.3, (rated HIGH), see below for details. The products found affected are:
Dell idrac6 1.97
Dell idrac7 1.57.57
Nessus says that the vulnerabilty is confirmed, and the openssl version could also be vulnerable to other openssl issues release on the same day as the OpenSSL 'ChangeCipherSpec' MiTM Vulnerability" released on the 5th of june.
Is this confirmed by dell? will patches be released for this vulnerabilties?
CVE-2010-5298, CVE-2014-0076, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221, CVE-2014-0224, CVE-2014-3470
DELL-Chris H
7 Practitioner
•
9682 Posts
•
48046 Points
2939
0
Posted June 25th, 2014 09:00
Surfarn,
We are researching the issue with engineering. I should have more information shortly. I apologize for the delay.
DELL-Chris H
Social Media and Communities Professional
Dell Technologies | Enterprise Support Services
#IWork4Dell
Did I answer your query? Please click on ‘Mark as Accepted Answer’. ‘Thumbs up’ the posts you like!DELL-Chris H
7 Practitioner
•
9682 Posts
•
48046 Points
2939
0
Posted June 26th, 2014 12:00
I am awaiting a response now. Sorry again for the added delay. Thank you for being so patient while we research the issue.
DELL-Chris H
Social Media and Communities Professional
Dell Technologies | Enterprise Support Services
#IWork4Dell
Did I answer your query? Please click on ‘Mark as Accepted Answer’. ‘Thumbs up’ the posts you like!DELL-Chris H
7 Practitioner
•
9682 Posts
•
48046 Points
2938
0
Posted July 2nd, 2014 13:00
Sorry for the delay, and again thank you for being patient with me while researching the issue and putting together the information.
I have emailed each of you (Surfarn, Topcat71, CEggen, t4r , TBD676) individually with the results.
Let me know if this helps.
DELL-Chris H
Social Media and Communities Professional
Dell Technologies | Enterprise Support Services
#IWork4Dell
Did I answer your query? Please click on ‘Mark as Accepted Answer’. ‘Thumbs up’ the posts you like!
ChrisWat
8 Posts
2882
1
Posted August 14th, 2014 08:00
Here is what I received for the Dell Response to Openssl vulnerability.
After a couple of calls to technical support here is what I'm getting for my iDRAC7 getting flagged by Foundstone security scans for the vulnerability CVE-2014-0224:
" The OPEN SSL package used here contains multiple components, the component that is impacted and vulnerable is not being used, other components in this package are being used but aren't vulnerable".
"Dell has determined that the products listed in the attached document are not affected by the vulnerabilities. Some products have leveraged an older (but not vulnerable) OpenSSL module. These could be flagged by a scanner. Dell is currently working on updating the modules to a version that will not be flagged for these issues".
I've also attempted to upload the document, hopefully it can be viewed or downloaded.
If this post has helped you please rate it.
Thanks
[View:~/cfs-file.ashx/__key/communityserver-discussions-components-files/177/2376.Dell_2D00_ResponseOpenSSLSecurityAdvisory_5F00_05_5F00_June_5F00_2014_5F00_final.pdf:550:0]