PT-2019-16652 · Dell Emc · Idrac9+3

Publicado 2019-04-26 · Atualizado 2020-10-16 · CVE-2019-3705

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC6 versions prior to 2.92 Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 Dell EMC iDRAC9 versions prior to 3.20.21.20 Dell EMC iDRAC9 versions prior to 3.21.24.22 Dell EMC iDRAC9 versions prior to 3.21.26.22 Dell EMC iDRAC9 versions prior to 3.23.23.23

Description The issue is a stack-based buffer overflow that can be exploited by an unauthenticated remote attacker. By sending specially crafted input data to the affected system, the attacker may crash the webserver or execute arbitrary code on the system with privileges of the webserver.

Recommendations For Dell EMC iDRAC6 versions prior to 2.92, update to version 2.92 or later. For Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60, update to version 2.61.60.60 or later. For Dell EMC iDRAC9 versions prior to 3.20.21.20, update to version 3.20.21.20 or later. For Dell EMC iDRAC9 versions prior to 3.21.24.22, update to version 3.21.24.22 or later. For Dell EMC iDRAC9 versions prior to 3.21.26.22, update to version 3.21.26.22 or later. For Dell EMC iDRAC9 versions prior to 3.23.23.23, update to version 3.23.23.23 or later.

Correção

Memory Corruption

Buffer Overflow

Enumeração de Fraquezas

CWE-787

CWE-120

Identificadores relacionados

CVE-2019-3705

Produtos afetados

Idrac6

Idrac7

Idrac8

Idrac9

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-3705 · Aviso do Fabricante
• https://dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3705 · Nota de Segurança