DSA-2024-163: Security Update for Dell PowerScale OneFS for Multiple Security Vulnerabilities

요약: Dell PowerScale OneFS remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.

이 문서는 다음에 적용됩니다. 이 문서는 다음에 적용되지 않습니다. 이 문서는 특정 제품과 관련이 없습니다. 모든 제품 버전이 이 문서에 나와 있는 것은 아닙니다.

영향

Medium

세부 정보

Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2024-25967 Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25970 Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25969 Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25965 Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:HThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25968 Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
 CVE-2024-25966 Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LThis hyperlink is taking you to a website outside of Dell Technologies.
Proprietary Code CVEs Description CVSS Base Score CVSS Vector String
CVE-2024-25967 Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25970 Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25969 Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25965 Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. 6.1 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:HThis hyperlink is taking you to a website outside of Dell Technologies.
CVE-2024-25968 Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NThis hyperlink is taking you to a website outside of Dell Technologies.
 CVE-2024-25966 Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LThis hyperlink is taking you to a website outside of Dell Technologies.
Dell Technologies는 모든 고객이 CVSS 기본 점수와 관련 임시 및 환경 점수를 모두 고려할 것을 권장합니다. 이 경우 특정 보안 취약성과 관련된 잠재적인 심각도에 영향을 미칠 수 있습니다.

영향을 받는 제품 및 문제 해결

CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 8.2.x through 9.3.0.0  Version 9.5.0.8 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.4.0.0 through 9.4.0.17 Version 9.5.0.8 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 PowerScale OneFS Version 9.4.0.0 through 9.4.0.17 Version 9.4.0.18 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.5.0.0 through 9.5.0.7 Version 9.5.0.8 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.6.0.x through 9.7.0.1 Version 9.7.0.3 or later PowerScale OneFS Downloads Area
CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.7.0.2 Version 9.7.0.3 or later PowerScale OneFS Downloads Area
CVEs Addressed Product Affected Versions Remediated Versions Link
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 8.2.x through 9.3.0.0  Version 9.5.0.8 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.4.0.0 through 9.4.0.17 Version 9.5.0.8 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 PowerScale OneFS Version 9.4.0.0 through 9.4.0.17 Version 9.4.0.18 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.5.0.0 through 9.5.0.7 Version 9.5.0.8 or later PowerScale OneFS Downloads Area
CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.6.0.x through 9.7.0.1 Version 9.7.0.3 or later PowerScale OneFS Downloads Area
CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 PowerScale OneFS Version 9.7.0.2 Version 9.7.0.3 or later PowerScale OneFS Downloads Area
Note: Any version not listed in the Affected Products and Remediation section should upgrade PowerScale OneFS to a version 9.5.0.8 or later.
We encourage all customers to adopt the Long Term Support (LTS) 2023 version which is 9.5.x code line, with the latest maintenance RUP 9.5.0.8 For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary

해결 방법 및 완화 방안

CVE Workaround
CVE-2024-25966 This vulnerability can be mitigated on PowerScale OneFS by disabling the SMB1.
Refer section Disable SMB1 in the below document to disable the SMB1 manually.
PowerScale OneFS 9.5.0.0 Security Configuration Guide

개정 내역

RevisionDateDescription
1.02024-05-07Initial Release
2.02024-10-03Updated for enhanced presentation with no changes to content. 

관련 정보

해당 제품

PowerScale OneFS
문서 속성
문서 번호: 000224860
문서 유형: Dell Security Advisory
마지막 수정 시간: 03 10월 2024
다른 Dell 사용자에게 질문에 대한 답변 찾기
지원 서비스
디바이스에 지원 서비스가 적용되는지 확인하십시오.