DSA-2024-074: Security Update for Dell EMC License Manager privilege elevation vulnerability
概要: Dell EMC License Manager remediation is available for privilege elevation vulnerability that could be exploited by malicious users to compromise the affected system.
この記事は次に適用されます：
この記事は次には適用されません：
この記事は、特定の製品に関連付けられていません。
すべての製品パージョンがこの記事に記載されているわけではありません。
影響
Medium
詳細
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-22456 | Dell EMC License Manager, 1.7.1, contains a privilege elevation vulnerability. An authenticated non-admin attacker could potentially exploit this vulnerability, leading to arbitrary code execution. Exploitation may lead to a complete system compromise. | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-22456 | Dell EMC License Manager, 1.7.1, contains a privilege elevation vulnerability. An authenticated non-admin attacker could potentially exploit this vulnerability, leading to arbitrary code execution. Exploitation may lead to a complete system compromise. | 6.7 | CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H |
影響を受ける製品と修復
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2024-22456 | Dell EMC License Manager | Versions prior to 1.7.2 | 1.7.2 and later | Dell EMC License Manager 1.7.2 |
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2024-22456 | Dell EMC License Manager | Versions prior to 1.7.2 | 1.7.2 and later | Dell EMC License Manager 1.7.2 |
The vulnerability does not exist if Dell EMC License Manager is installed in the default location recommended by the installer. (C:\Program Files (x86)\Dell\SysMgt\LicenseManager)
回避策と緩和策
| CVE ID | Workaround and Mitigation |
|---|---|
| CVE-2024-22456 | Install Dell EMC License Manager in the default location (C:\Program Files (x86)\Dell\SysMgt\LicenseManager) |
変更履歴
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2024-02-08 | Initial Release |
| 2.0 | 2024-05-22 | Updated to include external link icon with no other changes to content. |
確認
Dell would like to thank Pwni for reporting this issue.
関連情報
法的免責事項
対象製品
Dell License Manager (DLM)文書のプロパティ
文書番号: 000221947
文書の種類: Dell Security Advisory
最終更新: 22 5月 2024
質問に対する他のDellユーザーからの回答を見つける
サポート サービス
お使いのデバイスがサポート サービスの対象かどうかを確認してください。