DSA-2024-163: Security Update for Dell PowerScale OneFS for Multiple Security Vulnerabilities
Riepilogo: Dell PowerScale OneFS remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
Questo articolo si applica a
Questo articolo non si applica a
Questo articolo non è legato a un prodotto specifico.
Non tutte le versioni del prodotto sono identificate in questo articolo.
Impatto
Medium
Dettagli
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-25967 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVE-2024-25970 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CVE-2024-25969 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVE-2024-25965 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. | 6.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H |
| CVE-2024-25968 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2024-25966 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-25967 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVE-2024-25970 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CVE-2024-25969 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVE-2024-25965 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. | 6.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H |
| CVE-2024-25968 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2024-25966 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Prodotti interessati e correzione
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 8.2.x through 9.3.0.0 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.4.0.18 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.5.0.0 through 9.5.0.7 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.6.0.x through 9.7.0.1 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.7.0.2 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 8.2.x through 9.3.0.0 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.4.0.18 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.5.0.0 through 9.5.0.7 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.6.0.x through 9.7.0.1 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.7.0.2 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
Note: Any version not listed in the Affected Products and Remediation section should upgrade PowerScale OneFS to a version 9.5.0.8 or later.
We encourage all customers to adopt the Long Term Support (LTS) 2023 version which is 9.5.x code line, with the latest maintenance RUP 9.5.0.8 For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary
We encourage all customers to adopt the Long Term Support (LTS) 2023 version which is 9.5.x code line, with the latest maintenance RUP 9.5.0.8 For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary
Soluzioni alternative e mitigazioni
| CVE | Workaround |
|---|---|
| CVE-2024-25966 | This vulnerability can be mitigated on PowerScale OneFS by disabling the SMB1. Refer section Disable SMB1 in the below document to disable the SMB1 manually. PowerScale OneFS 9.5.0.0 Security Configuration Guide |
Cronologia delle revisioni
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2024-05-07 | Initial Release |
| 2.0 | 2024-10-03 | Updated for enhanced presentation with no changes to content. |
Informazioni correlate
Dichiarazione di non responsabilità
Prodotti interessati
PowerScale OneFSProprietà dell'articolo
Numero articolo: 000224860
Tipo di articolo: Dell Security Advisory
Ultima modifica: 03 ott 2024
Trova risposta alle tue domande dagli altri utenti Dell
Support Services
Verifica che il dispositivo sia coperto dai Servizi di supporto.