PowerEdge: Dell EMC iDRAC Multiple Vulnerabilities (CVE-2018-15774 and CVE-2018-15776)

Summary: Dell EMC guidance to mitigate risk and resolution for the iDRAC multiple vulnerabilities. For specific information about affected iDRAC versions and next steps to apply the updates, see this guide. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Symptoms

CVE Identifier: CVE-2018-15774, CVE-2018-15776

Severity: Medium

Affected products:

  • Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 (CVE-2018-15774 and CVE-2018-15776)
  • Dell EMC iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22 and 3.23.23.23 (CVE-2018-15774)

Summary: 
Dell EMC iDRAC has been updated to address multiple vulnerabilities which may potentially be exploited to compromise the affected systems.
 
Details: 

  • Privilege Escalation Vulnerability (CVE-2018-15774)
Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 and iDRAC9 versions prior to 3.20.21.20, 3.21.24.22, 3.21.26.22, and 3.23.23.23 contain a privilege escalation vulnerability. An authenticated malicious iDRAC user with operator privileges could potentially exploit a permissions check flaw in the Redfish interface to gain administrator access.

 
 

  • Improper Error Handling Vulnerability (CVE-2018-15776)
Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell.
 
Note: Other models of iDRAC are not affected by the vulnerabilities detailed above.

 

Cause

.

Resolution

Resolution:   
The following Dell EMC iDRAC firmware releases contain resolutions to these vulnerabilities:

 

iDRAC iDRAC firmware Version

iDRAC9
3.20.21.20
3.21.24.22
3.21.26.22
3.23.23.23
iDRAC8 2.61.60.60
iDRAC7 2.61.60.60

 

Note: Available as of the publication date

Dell Technologies recommends all customers upgrade at the earliest opportunity. 

Dell EMC Best Practices regarding iDRAC:

In addition to maintaining up-to-date iDRAC firmware, Dell EMC also advises the following:

  • iDRACs are not designed nor intended to be placed on or connected to the internet; they are intended to be on a separate management network. Placing or connecting iDRACs directly to the internet could expose the connected system to security and other risks for which Dell EMC is not responsible.  
  • Along with locating iDRACs on a separate management subnet, users should isolate the management subnet/vLAN with technologies such as firewalls, and limit access to the subnet/vLAN to authorized server administrators.
  • Dell Technologies recommends that customers consider any deployment factors that may be relevant to their environment to assess their overall risk.

Link to remedies:

Customers can download iDRAC firmware for PowerEdge servers and for all other platforms, select the platform from the Dell support site.


Credit:

CVE-2018-15776: Dell EMC would like to thank Jon Sands and Adam Nielsen for reporting this issue to us.

Dell Technologies recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. Dell EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title, and non-infringement. In no event shall Dell EMC, or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Dell EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.

Affected Products

Hyper-converged Systems, Datacenter Scalable Solutions, PowerEdge, iDRAC7/8 with Lifecycle Controller Version 2.61.60.60, Precision 7920 Rack, Precision Rack 7910

Products

PowerEdge XR2, PowerEdge FC640, PowerEdge M640, PowerEdge M640 (for PE VRTX), PowerEdge MX740C, PowerEdge MX750c, PowerEdge MX760c, PowerEdge MX840C, PowerEdge R240, PowerEdge R250, PowerEdge R260, PowerEdge R340, PowerEdge R350, PowerEdge R360 , PowerEdge R440, PowerEdge R450, PowerEdge R540, PowerEdge R550, PowerEdge R640, PowerEdge R6415, PowerEdge R650, PowerEdge R650xs, PowerEdge R6515, PowerEdge R6525, PowerEdge R660, PowerEdge R660xs, PowerEdge R6615, PowerEdge R6625, PowerEdge R740, PowerEdge R740XD, PowerEdge R740XD2, PowerEdge R7415, PowerEdge R7425, PowerEdge R750, PowerEdge R750XA, PowerEdge R750xs, PowerEdge R7515, PowerEdge R7525, PowerEdge R760, PowerEdge R760XA, PowerEdge R760xd2, PowerEdge R760xs, PowerEdge R7615, PowerEdge R7625, PowerEdge R840, PowerEdge R860, PowerEdge R940, PowerEdge R940xa, PowerEdge R960, PowerEdge T140, PowerEdge T150, PowerEdge T160, PowerEdge T340, PowerEdge T350, PowerEdge T360, PowerEdge T440, PowerEdge T550, PowerEdge T560, PowerEdge T640, PowerEdge XE2420, PowerEdge XE7420, PowerEdge XE7440, PowerEdge XE8545, PowerEdge XE8640, PowerEdge XE9640, PowerEdge XE9680, PowerEdge XR11, PowerEdge XR12, PowerEdge XR4510c, PowerEdge XR4520c ...
Article Properties
Article Number: 000177031
Article Type: Solution
Last Modified: 09 Dec 2024
Version:  6
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.