DSA-2021-177: Dell EMC iDRAC Security Update for Multiple Security Vulnerabilities
摘要: Dell EMC iDRAC remediation is available for multiple security vulnerabilities that may be exploited by malicious users to compromise the affected system.
本文章適用於
本文章不適用於
本文無關於任何特定產品。
本文未識別所有產品版本。
影響
High
詳細資料
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-36299 | Dell iDRAC9 versions 4.40.00.00 and later but before 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application. | 7.1 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L |
| CVE-2021-36300 | iDRAC9 versions before 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to make the webserver unresponsive or cause information disclosure. |
6.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L |
| CVE-2021-36301 | Dell iDRAC9 before version 4.40.40.00 and iDRAC8 before version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system. | 5.9 | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |
| Third-party Component | CVEs | More information |
| ZeroMQ | CVE-2021-20235 | See NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-20235) for individual scores for each CVE. |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
| CVE-2021-36299 | Dell iDRAC9 versions 4.40.00.00 and later but before 4.40.29.00 and 5.00.00.00 contain an SQL injection vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to cause information disclosure or denial of service by supplying specially crafted input data to the affected application. | 7.1 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L |
| CVE-2021-36300 | iDRAC9 versions before 5.00.00.00 contain an improper input validation vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability by sending a specially crafted malicious request to make the webserver unresponsive or cause information disclosure. |
6.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L |
| CVE-2021-36301 | Dell iDRAC9 before version 4.40.40.00 and iDRAC8 before version 2.80.80.80 contain a Stack Buffer Overflow in Racadm. An authenticated remote attacker may potentially exploit this vulnerability to control process execution and gain access to the underlying operating system. | 5.9 | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N |
| Third-party Component | CVEs | More information |
| ZeroMQ | CVE-2021-20235 | See NVD (https://nvd.nist.gov/vuln/detail/CVE-2021-20235) for individual scores for each CVE. |
受影響的產品與補救措施
| CVEs Addressed | Product | Affected Versions | Updated Versions | Link to Update |
| CVE-2021-36299 | Dell EMC iDRAC9 | Versions 4.40.00.00 and later, but before 4.40.29.00 and 5.00.00.00 | 4.40.29.00 and 5.00.00.00 | 4.40.29.00 5.00.00.00 |
| CVE-2021-36300 | Dell EMC iDRAC9 |
Versions before 5.00.00.00 | 5.00.00.00 | 5.00.00.00 |
| CVE-2021-20235 | Dell EMC iDRAC9 Group Manager feature over the IPv6 linklocal interface |
Versions before 5.00.10.00 | 5.00.10.00 | 5.10.10.00 Note: Version 5.00.10.00 has been demoted. If version 5.00.10.00 was not applied before demotion, see Workarounds and Mitigations section. |
| CVE-2021-36301 | Dell EMC iDRAC8 and Dell EMC iDRAC9 |
Versions before 2.80.80.80 and 4.40.40.00 | 2.80.80.80 and 4.40.40.00 | 2.80.80.80 4.40.40.00 |
| CVEs Addressed | Product | Affected Versions | Updated Versions | Link to Update |
| CVE-2021-36299 | Dell EMC iDRAC9 | Versions 4.40.00.00 and later, but before 4.40.29.00 and 5.00.00.00 | 4.40.29.00 and 5.00.00.00 | 4.40.29.00 5.00.00.00 |
| CVE-2021-36300 | Dell EMC iDRAC9 |
Versions before 5.00.00.00 | 5.00.00.00 | 5.00.00.00 |
| CVE-2021-20235 | Dell EMC iDRAC9 Group Manager feature over the IPv6 linklocal interface |
Versions before 5.00.10.00 | 5.00.10.00 | 5.10.10.00 Note: Version 5.00.10.00 has been demoted. If version 5.00.10.00 was not applied before demotion, see Workarounds and Mitigations section. |
| CVE-2021-36301 | Dell EMC iDRAC8 and Dell EMC iDRAC9 |
Versions before 2.80.80.80 and 4.40.40.00 | 2.80.80.80 and 4.40.40.00 | 2.80.80.80 4.40.40.00 |
因應措施與緩解措施
CVE-2021-20235 is mitigated in Dell EMC iDRAC9 when the Group Manager Feature is disabled. For Group Manager configuration steps, see the iDRAC9 Security Configuration Guide.
修訂歷史記錄
| Revision | Date | Description |
| 1.0 | 2021-09-09 | Initial Release |
| 2.0 | 2021-10-01 | Update to Affected Products and Remediation section and Workarounds and Mitigations section |
| 2.1 | 2022-05-26 | Updated Affected Products and Remediation section |
| 2.2 | 2023-05-01 | Reformatted for improved presentation without any changes to content. |
相關資訊
法律免責聲明
受影響的產品
iDRAC8, iDRAC9, iDRAC9 - 3.0x Series, iDRAC9 - 3.1x Series, iDRAC9 - 3.2x Series, iDRAC9 - 3.3x Series, iDRAC9 - 3.4x Series, iDRAC9 - 4.xx Series, iDRAC9 - 5.xx Series, Product Security Information文章屬性
文章編號: 000191229
文章類型: Dell Security Advisory
上次修改時間: 01 5月 2023
向其他 Dell 使用者尋求您問題的答案
支援服務
檢查您的裝置是否在支援服務的涵蓋範圍內。