Ga naar hoofdinhoud
  • Snel en eenvoudig bestellen
  • Bestellingen en de verzendstatus bekijken
  • Een lijst met producten maken en openen
  • Beheer uw Dell EMC locaties, producten en contactpersonen op productniveau met Company Administration.

Artikelnummer: 000185293


DSA-2021-073: Dell iDRAC 9 Security Update for Multiple Vulnerabilities

Samenvatting: Dell iDRAC 9 contains remediation for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.

Article content


Impact

Medium

Gegevens

Proprietary Code CVE(s) Description CVSS Base Score CVSS Vector String
CVE-2021-21539 Dell iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.  A remote authenticated attacker may potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface. 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
CVE-2021-21540 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability.  A remote authenticated attacker may potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload. 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
CVE-2021-21541 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.
 
6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2021-21542 Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVE-2021-21543 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVE-2021-21544 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.
 
2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Proprietary Code CVE(s) Description CVSS Base Score CVSS Vector String
CVE-2021-21539 Dell iDRAC9 versions prior to 4.40.00.00 contain a Time-of-check Time-of-use (TOCTOU) race condition vulnerability.  A remote authenticated attacker may potentially exploit this vulnerability to gain elevated privileges when a user with higher privileges is simultaneously accessing iDRAC through the web interface. 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
CVE-2021-21540 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a stack-based overflow vulnerability.  A remote authenticated attacker may potentially exploit this vulnerability to overwrite configuration information by injecting arbitrarily large payload. 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L
CVE-2021-21541 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain a DOM-based cross-site scripting vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability by tricking a victim application user to supply malicious HTML or JavaScript code to DOM environment in the browser. The malicious code is then executed by the web browser in the context of the vulnerable web application.
 
6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2021-21542 Dell EMC iDRAC9 versions prior to 4.40.10.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected while generating a certificate. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVE-2021-21543 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected parameters. When victim users access the submitted data through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable application. 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVE-2021-21544 Dell EMC iDRAC9 versions prior to 4.40.00.00 contain an improper authentication vulnerability. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to manipulate the username field under the comment section and set the value to any user.
 
2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Dell Technologies raadt aan dat alle klanten rekening houden met zowel de basisscore van CVSS als alle relevante tijdelijke en omgevingsscores die gevolgen kunnen hebben voor de mogelijke ernst van de specifieke beveiligingsproblemen.

Getroffen producten en herstel

CVE(s) Product Affected Version(s) Updated Version(s) Link to Update
CVE-2021-21539 iDRAC9 Versions prior to 4.40.00.00 4.40.00.00 and later Customers can download software, including the latest release of iDRAC firmware, from the Dell Support site.
https://www.dell.com/support/home/

Customers can find the iDRAC documentation from the Dell EMC Support site.
www.dell.com/idracmanuals
CVE-2021-21540
CVE-2021-21541
CVE-2021-21543
CVE-2021-21544
CVE-2021-21542 iDRAC9 Versions prior to 4.40.10.00 4.40.10.00 and later
CVE(s) Product Affected Version(s) Updated Version(s) Link to Update
CVE-2021-21539 iDRAC9 Versions prior to 4.40.00.00 4.40.00.00 and later Customers can download software, including the latest release of iDRAC firmware, from the Dell Support site.
https://www.dell.com/support/home/

Customers can find the iDRAC documentation from the Dell EMC Support site.
www.dell.com/idracmanuals
CVE-2021-21540
CVE-2021-21541
CVE-2021-21543
CVE-2021-21544
CVE-2021-21542 iDRAC9 Versions prior to 4.40.10.00 4.40.10.00 and later

Bevestigingen

CVE-2021-21541: Dell would like to thank Fabian Bräunlein of Positive Security.
CVE-2021-21542, CVE-2021-21543, and CVE-2021-21544: Dell would like to thank Tomasz Holeksa.

Revisiegeschiedenis

RevisionDateDescription
1.02021-04-14Initial Release

Verwante informatie

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide


Artikeleigenschappen


Getroffen product

iDRAC9

Product

Product Security Information

Datum laatst gepubliceerd

20 apr 2021

Versie

2

Artikeltype

Dell Security Advisory