DSA-2019-137: iDRAC Improper Authorization Vulnerability
概要: Dell EMC Servers require a security update to address vulnerabilities in iDRAC Improper Authorization Vulnerability. For specific information on affected platforms and next steps to apply the updates, please refer to this guide. ...
この記事は次に適用されます：
この記事は次には適用されません：
この記事は、特定の製品に関連付けられていません。
すべての製品パージョンがこの記事に記載されているわけではありません。
影響
Medium
詳細
-
Improper Authorization Vulnerability
Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.
-
Improper Authorization Vulnerability
Dell EMC iDRAC7 versions prior to 2.65.65.65, iDRAC8 versions prior to 2.70.70.70 and iDRAC9 versions prior to 3.36.36.36 contain an improper authorization vulnerability. A remote authenticated malicious iDRAC user with low privileges may potentially exploit this vulnerability to obtain sensitive information such as password hashes.
影響を受ける製品と修復
Affected products:
The following Dell EMC iDRAC firmware releases contain resolutions to these vulnerabilities:
Note: iDRAC9 and iDRAC8 firmware is available as of the publication date. iDRAC7 firmware is planned to be available April 2020.
Dell EMC recommends all customers upgrade at the earliest opportunity.
Dell EMC Best Practices regarding iDRAC:
In addition to maintaining up-to-date iDRAC firmware, Dell EMC also advises the following:
https://www.dell.com/support/home/products/server_int/server_int_poweredge
- Dell EMC iDRAC7 versions prior to 2.65.65.65
- Dell EMC iDRAC8 versions prior to 2.70.70.70
- Dell EMC iDRAC9 versions prior to 3.36.36.36
The following Dell EMC iDRAC firmware releases contain resolutions to these vulnerabilities:
| iDRAC | iDRAC firmware version |
| iDRAC9 | 3.36.36.36 |
| 3.40.40.40 | |
| iDRAC8 | 2.70.70.70 |
| iDRAC7 | 2.65.65.65 |
Note: iDRAC9 and iDRAC8 firmware is available as of the publication date. iDRAC7 firmware is planned to be available April 2020.
Dell EMC recommends all customers upgrade at the earliest opportunity.
Dell EMC Best Practices regarding iDRAC:
In addition to maintaining up-to-date iDRAC firmware, Dell EMC also advises the following:
- iDRACs are not designed nor intended to be placed on or connected to the internet; they are intended to be on a separate management network. Placing or connecting iDRACs directly to the internet could expose the connected system to security and other risks for which Dell EMC is not responsible.
- Along with locating iDRACs on a separate management subnet, users should isolate the management subnet/VLAN with technologies such as firewalls, and limit access to the subnet/VLAN to authorized server administrators.
- Dell EMC recommends that customers take into account any deployment factors that may be relevant to their environment to assess their overall risk.
https://www.dell.com/support/home/products/server_int/server_int_poweredge
Affected products:
The following Dell EMC iDRAC firmware releases contain resolutions to these vulnerabilities:
Note: iDRAC9 and iDRAC8 firmware is available as of the publication date. iDRAC7 firmware is planned to be available April 2020.
Dell EMC recommends all customers upgrade at the earliest opportunity.
Dell EMC Best Practices regarding iDRAC:
In addition to maintaining up-to-date iDRAC firmware, Dell EMC also advises the following:
https://www.dell.com/support/home/products/server_int/server_int_poweredge
- Dell EMC iDRAC7 versions prior to 2.65.65.65
- Dell EMC iDRAC8 versions prior to 2.70.70.70
- Dell EMC iDRAC9 versions prior to 3.36.36.36
The following Dell EMC iDRAC firmware releases contain resolutions to these vulnerabilities:
| iDRAC | iDRAC firmware version |
| iDRAC9 | 3.36.36.36 |
| 3.40.40.40 | |
| iDRAC8 | 2.70.70.70 |
| iDRAC7 | 2.65.65.65 |
Note: iDRAC9 and iDRAC8 firmware is available as of the publication date. iDRAC7 firmware is planned to be available April 2020.
Dell EMC recommends all customers upgrade at the earliest opportunity.
Dell EMC Best Practices regarding iDRAC:
In addition to maintaining up-to-date iDRAC firmware, Dell EMC also advises the following:
- iDRACs are not designed nor intended to be placed on or connected to the internet; they are intended to be on a separate management network. Placing or connecting iDRACs directly to the internet could expose the connected system to security and other risks for which Dell EMC is not responsible.
- Along with locating iDRACs on a separate management subnet, users should isolate the management subnet/VLAN with technologies such as firewalls, and limit access to the subnet/VLAN to authorized server administrators.
- Dell EMC recommends that customers take into account any deployment factors that may be relevant to their environment to assess their overall risk.
https://www.dell.com/support/home/products/server_int/server_int_poweredge
確認
CVE-2019-3764: Dell EMC would like to thank the MilCert Austrian Armed Forces for reporting this issue to us.
関連情報
法的免責事項
対象製品
iDRAC7, iDRAC8, iDRAC9, iDRAC7 with Lifecycle Controller Version 2.22.22.22, iDRAC7 with Lifecycle Controller Version 2.13.13.12, iDRAC7 with Lifecycle Controller Version 2.15.10.10, iDRAC7 with Lifecycle Controller Version 2.43.43.43
, iDRAC7 with Lifecycle Controller Version 2.21.21.21, iDRAC7 with Lifecycle Controller Version 2.30.30.30, iDRAC7 with Lifecycle Controller Version 2.40.40.40, iDRAC7 with Lifecycle Controller Version 2.41.40.40, iDRAC7/8 with Lifecycle Controller Version 2.50.50.50, iDRAC7/8 with Lifecycle Controller Version 2.52.52.52, iDRAC7/8 with Lifecycle Controller Version 2.60.60.60, iDRAC7/8 with Lifecycle Controller Version 2.61.60.60, iDRAC7/8 with Lifecycle Controller Version 2.62.60.60, iDRAC7/8 with Lifecycle Controller Version 2.63.60.61, iDRAC7/8 with Lifecycle Controller Version 2.63.60.62, iDRAC7 with Lifecycle Controller Version 2.10.10.10, iDRAC7 with Lifecycle Controller Version 2.20.20.20, iDRAC7 with Lifecycle Controller Version 2.31.31.30, iDRAC7 with Lifecycle Controller Version 2.32.31.30, iDRAC7 Version 1.65.65, iDRAC7 Version 1.66.65, iDRAC8 with Lifecycle Controller Version 2.12.12.12, iDRAC8 with Lifecycle Controller Version 2.14.14.12, iDRAC8 with Lifecycle Controller Version 2.17.17.13, iDRAC8 with Lifecycle Controller Version 2.18.17.13, iDRAC8 with Lifecycle Controller Version 2.30.119.30, iDRAC8 with Lifecycle Controller Version 2.35.35.35, iDRAC8 with Lifecycle Controller Version 2.42.110.40, iDRAC8 with Lifecycle Controller Version 2.45.45.40, iDRAC8 with Lifecycle Controller Version 2.55.55.50, iDRAC8 with Lifecycle Controller Version 2.04.02.01, iDRAC8 with Lifecycle Controller Version 2.05.05.05, iDRAC8 with Lifecycle Controller Version 2.23.23.21, iDRAC9 - 3.0x Series, iDRAC9 - 3.1x Series, iDRAC9 - 3.2x Series, iDRAC9 - 3.3x Series, iDRAC7 Version 1.00.00, iDRAC7 Version 1.10.10, iDRAC7 Version 1.20.20, iDRAC7 Version 1.30.30, iDRAC7 Version 1.35.35, iDRAC7 Version 1.40.40, iDRAC7 Version 1.50.50, iDRAC7 Version 1.51.51, iDRAC7 Version 1.55.55, iDRAC7 Version 1.56.55, iDRAC7 Version 1.57.57, iDRAC8 with Lifecycle Controller Version 2.00.00.00, iDRAC8 with Lifecycle Controller Version 2.02.01.01, Product Security Information
...
文書のプロパティ
文書番号: 000177303
文書の種類: Dell Security Advisory
最終更新: 06 5月 2026
質問に対する他のDellユーザーからの回答を見つける
サポート サービス
お使いのデバイスがサポート サービスの対象かどうかを確認してください。