PT-2013-5192 · Dell · Dell Idrac6

Published 2013-07-08 · Updated 2013-09-27 · CVE-2013-4785

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell iDRAC6 versions prior to 1.95

Description The issue affects the web interface of the Dell iDRAC6, allowing remote attackers to modify the CLP interface for arbitrary users via a request to an unspecified form accessible from testurls.html. The vendor has stated that DRACs are intended for separate management networks and not for internet connection, disputing the significance of this issue.

Recommendations For versions prior to 1.95, update the firmware to version 1.95 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2013-4785

Affected Products

Dell Idrac6

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-4785 · Security Note
• http://fish2.com/ipmi/dell/secret.html · Note
• ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-monolithic-srvr-v1.95_FAQ2_en-us.pdf · Note
• http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-check-if-ipmi-cipher-0-is-off.aspx · Note