DSA-2019-199: Dell EMC Avamar Intel Microarchitectural Data Sampling Vulnerabilities

The components are updated for the following vulnerabilities:   

• Microarchitectural Store Buffer Data Sampling (MSBDS)

CVE-2018-12126

• Microarchitectural Load Port Data Sampling (MLPDS)

CVE-2018-12127

• Microarchitectural Fill Buffer Data Sampling (MFBDS)

CVE-2018-12130 

• Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

CVE-2019-11091 

See NVD (http://nvd.nist.gov/) for individual scores for each CVE

Affected products:      
Dell EMC Avamar Data Store Gen4T
Dell EMC Avamar Data Store Gen4S


Resolution:     
The following Dell EMC Avamar releases addresso these vulnerabilities. The resolution needs fixes for both Avamar application and hardware.

•  The following Dell EMC Avamar release contains resolutions for Avamar application:       

• Dell EMC Avamar and Networker     See KB article 539780: DSA-2019-201: Dell EMC Avamar and NetWorker Security Update for Multiple Third Component Vulnerabilities or the latest security update after 2019R3.

• The following Dell EMC Avamar release contains resolutions for Avamar hardware:    

• Dell EMC Avamar Data Store Gen4T   HOTFIX 310344

• Dell EMC Avamar Data Store Gen4S – HOTFIX 325501

Dell EMC recommends all customers upgrade at the earliest opportunity. Refer to KB Article 513978: How to install an Avamar .avp hotfix using Avamar Installer (AVI) for instructions on applying the hotfix.