DSA-2020-113: Dell Encryption and Dell Endpoint Security Suite Improper Access Control Vulnerability


DSA-2020-113: Dell Encryption and Dell Endpoint Security Suite Improper Access Control Vulnerability


DSA Identifier: DSA-2020-113

CVE Identifier: CVE-2020-5358

Severity: Medium

Severity Rating: CVSS Base Score: 6.7 (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)

Affected Products:

Dell Encryption prior to 10.7

Dell Endpoint Security Suite prior to 2.7

Summary:

Dell Encryption and Dell Endpoint Security Suite require an update to address an improper access control vulnerability.

Details:

Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability due to incorrect permissions. A local malicious user with low privileges could potentially exploit this vulnerability to gain elevated privilege on the affected system with the help of a symbolic link.

Resolution:

The following Dell Data Security releases contain a resolution to this vulnerability:

  • Dell Encryption version 10.7 or later
  • Dell Endpoint Security Suite 2.7 or later

Customers should use the latest version from Dell. Dell recommends installing the most current version of Dell Encryption to receive the latest security updates to the product.

Customers can download the latest Dell Encryption software here.

Dell Endpoint Security Suite Enterprise software will be made available to customers on their ddpe.credant.com accounts or can be obtained through Dell ProSupport.

Credit:

Dell would like to thank Hou JingYi (hjy79425575) of Qihoo 360 CERT for reporting this issue.

Severity Rating:

For an explanation of Severity Ratings, refer to Dell Vulnerability Response Policy. Dell EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.

Legal Information:

Dell recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. Dell disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall Dell or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Dell or its suppliers have been advised of the possibility of such damages.





Article ID: SLN321789

Last Date Modified: 06/11/2020 03:16 PM

Rate this article

Accurate
Useful
Easy to understand
Was this article helpful?
0/3000 characters
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\
characters left.