DSA-2021-073: Dell iDRAC 9 Security Update for Multiple Vulnerabilities
Résumé: Dell iDRAC 9 contains remediation for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.
Cet article concerne
Cet article ne concerne pas
Cet article n’est associé à aucun produit spécifique.
Toutes les versions du produit ne sont pas identifiées dans cet article.
Impact
Medium
Détails
| Proprietary Code CVE(s) | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21539 | Dell iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker may potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L |
| CVE-2021-21540 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker may potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L |
| CVE-2021-21541 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application. |
6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CVE-2021-21542 | Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| CVE-2021-21543 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| CVE-2021-21544 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user. |
2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
| Proprietary Code CVE(s) | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-21539 | Dell iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability. A remote authenticated attacker may potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L |
| CVE-2021-21540 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability. A remote authenticated attacker may potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L |
| CVE-2021-21541 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application. |
6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CVE-2021-21542 | Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| CVE-2021-21543 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. | 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N |
| CVE-2021-21544 | Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user. |
2.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N |
Produits concernés et mesure corrective
| CVE(s) | Product | Affected Version(s) | Updated Version(s) | Link to Update |
| CVE-2021-21539 | iDRAC9 | Versions prior to 4.40.00.00 | 4.40.00.00 and later | Customers can download software, including the latest release of iDRAC firmware, from the Dell Support site. https://www.dell.com/support/home/ Customers can find the iDRAC documentation from the Dell EMC Support site. www.dell.com/idracmanuals |
| CVE-2021-21540 | ||||
| CVE-2021-21541 | ||||
| CVE-2021-21543 | ||||
| CVE-2021-21544 | ||||
| CVE-2021-21542 | iDRAC9 | Versions prior to 4.40.10.00 | 4.40.10.00 and later |
| CVE(s) | Product | Affected Version(s) | Updated Version(s) | Link to Update |
| CVE-2021-21539 | iDRAC9 | Versions prior to 4.40.00.00 | 4.40.00.00 and later | Customers can download software, including the latest release of iDRAC firmware, from the Dell Support site. https://www.dell.com/support/home/ Customers can find the iDRAC documentation from the Dell EMC Support site. www.dell.com/idracmanuals |
| CVE-2021-21540 | ||||
| CVE-2021-21541 | ||||
| CVE-2021-21543 | ||||
| CVE-2021-21544 | ||||
| CVE-2021-21542 | iDRAC9 | Versions prior to 4.40.10.00 | 4.40.10.00 and later |
Historique des révisions
| Revision | Date | Description |
| 1.0 | 2021-04-14 | Initial Release |
Remerciements
CVE-2021-21541: Dell would like to thank Fabian Bräunlein of Positive Security.
CVE-2021-21542, CVE-2021-21543, and CVE-2021-21544: Dell would like to thank Tomasz Holeksa.
Informations connexes
Mention légale
Produits concernés
iDRAC9Produits
Product Security InformationPropriétés de l’article
Numéro d’article: 000185293
Type d’article: Dell Security Advisory
Dernière modification: 20 avr. 2021
Trouvez des réponses à vos questions auprès d’autres utilisateurs Dell
Services de support
Vérifiez si votre appareil est couvert par les services de support.