DSA-2023-284: Security Update for Dell EMC Enterprise SONiC OS command injection vulnerability when using remote user authentication.

Samenvatting: Dell EMC Enterprise SONiC remediation is available for OS command injection vulnerability that could be exploited by malicious users using remote user authentication to compromise the affected system. ...

Dit artikel is van toepassing op Dit artikel is niet van toepassing op Dit artikel is niet gebonden aan een specifiek product. Niet alle productversies worden in dit artikel vermeld.
Bekijk andere hulpbronnen

Impact

Critical

Gegevens

Proprietary Code CVEs Description  CVSS Base Score CVSS Vector String 
CVE-2023-32484 Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerability. A remote unauthenticated malicious user may exploit this vulnerability and escalate privileges up to the highest administrative level. This is a Critical vulnerability affecting certain protocols, Dell recommends customers to upgrade at the earliest opportunity. 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H This hyperlink is taking you to a website outside of Dell Technologies.
Proprietary Code CVEs Description  CVSS Base Score CVSS Vector String 
CVE-2023-32484 Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerability. A remote unauthenticated malicious user may exploit this vulnerability and escalate privileges up to the highest administrative level. This is a Critical vulnerability affecting certain protocols, Dell recommends customers to upgrade at the earliest opportunity. 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H This hyperlink is taking you to a website outside of Dell Technologies.
Dell Technologies raadt aan dat alle klanten rekening houden met zowel de basisscore van CVSS als alle relevante tijdelijke en omgevingsscores die gevolgen kunnen hebben voor de mogelijke ernst van de specifieke beveiligingsproblemen.

Getroffen producten en herstel

CVEs Addressed  Product  Affected Versions  Remediated Versions  Link 
CVE-2023-32484 Enterprise SONiC Distribution  3.5.x  3.5.5  https://www.dell.com/support
CVE-2023-32484 Enterprise SONiC Distribution 4.0.x 4.0.6 https://www.dell.com/support
CVE-2023-32484 Enterprise SONiC Distribution 4.1.0 4.1.1 https://www.dell.com/support
CVEs Addressed  Product  Affected Versions  Remediated Versions  Link 
CVE-2023-32484 Enterprise SONiC Distribution  3.5.x  3.5.5  https://www.dell.com/support
CVE-2023-32484 Enterprise SONiC Distribution 4.0.x 4.0.6 https://www.dell.com/support
CVE-2023-32484 Enterprise SONiC Distribution 4.1.0 4.1.1 https://www.dell.com/support

Tijdelijke oplossingen en risicobeperking

None

Revisiegeschiedenis

RevisionDateDescription
1.02023-08-02Initial Release

Verwante informatie

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Juridische verklaring van afstand

Getroffen producten

Enterprise SONiC Distribution
Artikeleigenschappen
Artikelnummer: 000216586
Artikeltype: Dell Security Advisory
Laatst aangepast: 18 aug. 2023
Vind antwoorden op uw vragen via andere Dell gebruikers
Support Services
Controleer of uw apparaat wordt gedekt door Support Services.