PT-2018-11165 · Dell Emc · Idrac9+3

Publicado 2018-07-02 · Atualizado 2019-10-09 · CVE-2018-1243

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC6 versions prior to 2.91 Dell EMC iDRAC7/iDRAC8 versions prior to 2.60.60.60 Dell EMC iDRAC9 versions prior to 3.21.21.21

Description The issue concerns a weak CGI session ID. Sessions invoked via CGI binaries use 96-bit numeric-only session ID values. This weakness makes it easier for remote attackers to perform brute-force session guessing attacks.

Recommendations For Dell EMC iDRAC6 versions prior to 2.91, update to version 2.91 or later. For Dell EMC iDRAC7/iDRAC8 versions prior to 2.60.60.60, update to version 2.60.60.60 or later. For Dell EMC iDRAC9 versions prior to 3.21.21.21, update to version 3.21.21.21 or later.

Correção

Improperly Implemented Security Check for Standard

Enumeração de Fraquezas

CWE-358

Identificadores relacionados

CVE-2018-1243

Produtos afetados

Idrac6

Idrac7

Idrac8

Idrac9

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-1243 · Nota de Segurança
• http://en.community.dell.com/techcenter/extras/m/white_papers/20487494 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1243 · Aviso do Fabricante