Skip to main content
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.

Article Number: 000130360


DSA-2020-153: Dell EMC OpenManage Enterprise Tar File Extraction Vulnerability

Summary: DSA-2020-153: Dell EMC OpenManage Enterprise Tar File Extraction Vulnerability - CVE-2020-5370

Article Content


Impact

High

Details

  • Improper Control of Generation of Code (‘Code Injection’) (CVE-2020-5370)

Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to overwrite arbitrary files via directory traversal sequences using a crafted tar file to inject malicious RPMs which may cause a denial of service or perform unauthorized actions.

  • Improper Control of Generation of Code (‘Code Injection’) (CVE-2020-5370)

Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to overwrite arbitrary files via directory traversal sequences using a crafted tar file to inject malicious RPMs which may cause a denial of service or perform unauthorized actions.

Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products and Remediation

Affected products:
  • Dell EMC OpenManage Enterprise (OME) versions prior to 3.4
Resolution:   
The following Dell EMC OpenManage Enterprise (OME) release contain the resolution to the vulnerability:
  • Dell EMC OpenManage Enterprise (OME) 3.4 and later
Dell EMC recommends all customers upgrade at the earliest opportunity. 

Customers can download for PowerEdge servers. For all other platforms, please select the platform from the Dell support site.
Affected products:
  • Dell EMC OpenManage Enterprise (OME) versions prior to 3.4
Resolution:   
The following Dell EMC OpenManage Enterprise (OME) release contain the resolution to the vulnerability:
  • Dell EMC OpenManage Enterprise (OME) 3.4 and later
Dell EMC recommends all customers upgrade at the earliest opportunity. 

Customers can download for PowerEdge servers. For all other platforms, please select the platform from the Dell support site.
Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide


Article Properties


Affected Product

Dell EMC OpenManage Enterprise, Product Security Information

Last Published Date

21 Feb 2021

Version

4

Article Type

Dell Security Advisory