DSA-2023-124: Security Update for Dell SmartFabric OS10 Multiple Vulnerabilities.
Samenvatting: Dell SmartFabric OS10 remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
Dit artikel is van toepassing op
Dit artikel is niet van toepassing op
Dit artikel is niet gebonden aan een specifiek product.
Niet alle productversies worden in dit artikel vermeld.
Impact
Critical
Gegevens
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2023-28078 | Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible Denial of Service when a huge number of requests are sent to the switch. This is a high severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity. | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| CVE-2023-32462 | Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system takeover. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity. | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2023-28078 | Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. A remote unauthenticated attacker could potentially exploit this vulnerability leading to information disclosure and a possible Denial of Service when a huge number of requests are sent to the switch. This is a high severity vulnerability as it allows an attacker to view sensitive data. Dell recommends customers to upgrade at the earliest opportunity. | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H |
| CVE-2023-32462 | Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authentication. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands and possible system takeover. This is a critical vulnerability as it allows an attacker to cause severe damage. Dell recommends customers to upgrade at the earliest opportunity. | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Getroffen producten en herstel
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.0, 10.5.5.3 | 10.5.5.5 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.1 (MX), 10.5.5.2 (MX) |
10.5.5.4 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.x | 10.5.4.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.6 (MX) | 10.5.4.9 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.3.x | 10.5.3.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.2.x | 10.5.2.12 | https://www.dell.com/support |
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.0, 10.5.5.3 | 10.5.5.5 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.5.1 (MX), 10.5.5.2 (MX) |
10.5.5.4 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.x | 10.5.4.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.4.6 (MX) | 10.5.4.9 (MX) | DSA-2023-293: Security Update for Dell Networking MX Series Switches Vulnerabilities |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.3.x | 10.5.3.8 | https://www.dell.com/support |
| CVE-2023-28078, CVE-2023-32462 |
Dell SmartFabric OS10 | 10.5.2.x | 10.5.2.12 | https://www.dell.com/support |
Tijdelijke oplossingen en risicobeperking
None.
Revisiegeschiedenis
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2023-08-08 | Initial Release |
| 2.0 | 2023-08-08 | Updated for enhanced presentation with no changes to content. |
| 3.0 | 2023-08-09 | Major Revision: revised support links for MX versions and acknowledgements added. |
Bevestigingen
CVE-2023-28078: Dell Technologies would like to thank Rafael Schaefer, ERNW Enno Rey Netzwerke GmbH for reporting this issue.
Verwante informatie
Juridische verklaring van afstand
Artikeleigenschappen
Artikelnummer: 000216584
Artikeltype: Dell Security Advisory
Laatst aangepast: 09 aug. 2023
Vind antwoorden op uw vragen via andere Dell gebruikers
Support Services
Controleer of uw apparaat wordt gedekt door Support Services.