DSA-2024-163: Security Update for Dell PowerScale OneFS for Multiple Security Vulnerabilities
Samenvatting: Dell PowerScale OneFS remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
Dit artikel is van toepassing op
Dit artikel is niet van toepassing op
Dit artikel is niet gebonden aan een specifiek product.
Niet alle productversies worden in dit artikel vermeld.
Impact
Medium
Gegevens
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-25967 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVE-2024-25970 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CVE-2024-25969 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVE-2024-25965 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. | 6.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H |
| CVE-2024-25968 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2024-25966 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-25967 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVE-2024-25970 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CVE-2024-25969 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVE-2024-25965 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. | 6.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H |
| CVE-2024-25968 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2024-25966 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Getroffen producten en herstel
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 8.2.x through 9.3.0.0 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.4.0.18 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.5.0.0 through 9.5.0.7 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.6.0.x through 9.7.0.1 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.7.0.2 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVEs Addressed | Product | Affected Versions | Remediated Versions | Link |
|---|---|---|---|---|
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 8.2.x through 9.3.0.0 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.4.0.18 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.5.0.0 through 9.5.0.7 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.6.0.x through 9.7.0.1 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.7.0.2 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
Note: Any version not listed in the Affected Products and Remediation section should upgrade PowerScale OneFS to a version 9.5.0.8 or later.
We encourage all customers to adopt the Long Term Support (LTS) 2023 version which is 9.5.x code line, with the latest maintenance RUP 9.5.0.8 For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary
We encourage all customers to adopt the Long Term Support (LTS) 2023 version which is 9.5.x code line, with the latest maintenance RUP 9.5.0.8 For more information on LTS code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary
Tijdelijke oplossingen en risicobeperking
| CVE | Workaround |
|---|---|
| CVE-2024-25966 | This vulnerability can be mitigated on PowerScale OneFS by disabling the SMB1. Refer section Disable SMB1 in the below document to disable the SMB1 manually. PowerScale OneFS 9.5.0.0 Security Configuration Guide |
Revisiegeschiedenis
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2024-05-07 | Initial Release |
| 2.0 | 2024-10-03 | Updated for enhanced presentation with no changes to content. |
Verwante informatie
Juridische verklaring van afstand
Getroffen producten
PowerScale OneFSArtikeleigenschappen
Artikelnummer: 000224860
Artikeltype: Dell Security Advisory
Laatst aangepast: 03 okt. 2024
Vind antwoorden op uw vragen via andere Dell gebruikers
Support Services
Controleer of uw apparaat wordt gedekt door Support Services.