PT-2014-2690 · Dell · Powerconnect 3524P+3

Publicado 2014-01-20 · Atualizado 2017-08-29 · CVE-2013-3595

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerConnect switches, including: OpenManage web application version 2.5 build 1.19 Dell PowerConnect 3348 version 1.2.1.3 Dell PowerConnect 3524p version 2.0.0.48 Dell PowerConnect 5324 version 2.0.1.4

Description The issue allows remote authenticated users to cause a denial of service, resulting in a device reset, by sending a direct request to an unspecified OSPF URL.

Recommendations For OpenManage web application version 2.5 build 1.19, restrict access to the OSPF URL to minimize the risk of exploitation. For Dell PowerConnect 3348 version 1.2.1.3, consider disabling remote access until a fix is available. For Dell PowerConnect 3524p version 2.0.0.48, limit user privileges to reduce the impact of a potential denial of service. For Dell PowerConnect 5324 version 2.0.1.4, avoid using the OSPF protocol until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-3595

Produtos afetados

Openmanage

Powerconnect 3348

Powerconnect 3524P

Powerconnect 5324

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/90597 · Nota
• http://kb.cert.org/vuls/id/122582 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-3595 · Nota de Segurança