PT-2013-5192 · Dell · Dell Idrac6

Publicado 2013-07-08 · Atualizado 2013-09-27 · CVE-2013-4785

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell iDRAC6 versions prior to 1.95

Description The issue affects the web interface of the Dell iDRAC6, allowing remote attackers to modify the CLP interface for arbitrary users via a request to an unspecified form accessible from testurls.html. The vendor has stated that DRACs are intended for separate management networks and not for internet connection, disputing the significance of this issue.

Recommendations For versions prior to 1.95, update the firmware to version 1.95 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2013-4785

Produtos afetados

Dell Idrac6

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-4785 · Nota de Segurança
• http://fish2.com/ipmi/dell/secret.html · Nota
• ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-monolithic-srvr-v1.95_FAQ2_en-us.pdf · Nota
• http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-check-if-ipmi-cipher-0-is-off.aspx · Nota