PT-2018-10841 · Dell Emc · Emc Vasa Provider Virtual Appliance+13

Jakub Palaczynski

·

Published

2018-04-30

·

Updated

2018-06-13

·

CVE-2018-1183

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8 Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8 Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512 Dell EMC SMIS versions prior to 8.4.0.6 Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347 Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231 Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231 Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0 Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225 Dell EMC VNXe3200 Operating Environment (OE) all versions Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228 Dell EMC VNXe 3100/3150/3300 Operating Environment (OE) all versions Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2 Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3 Dell EMC XtremIO versions 4.x Dell EMC VMAX eNAS version 8.x Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968
Description The issue is related to an XXE injection vulnerability due to the configuration of the XML parser shipped with the product. This vulnerability may occur when XML input containing a reference to an external entity is processed by an affected XML parser, potentially allowing attackers to gain unauthorized access to files containing sensitive information or cause denial-of-service.
Recommendations For Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, update to version 8.4.0.8 or later. For Dell EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.8, update to version 8.4.0.8 or later. For Dell EMC VASA Provider Virtual Appliance versions prior to 8.4.0.512, update to version 8.4.0.512 or later. For Dell EMC SMIS versions prior to 8.4.0.6, update to version 8.4.0.6 or later. For Dell EMC VMAX Embedded Management (eManagement) versions prior to and including 1.4.0.347, update to a version later than 1.4.0.347. For Dell EMC VNX2 Operating Environment (OE) for File versions prior to 8.1.9.231, update to version 8.1.9.231 or later. For Dell EMC VNX2 Operating Environment (OE) for Block versions prior to 05.33.009.5.231, update to version 05.33.009.5.231 or later. For Dell EMC VNX1 Operating Environment (OE) for File versions prior to 7.1.82.0, update to version 7.1.82.0 or later. For Dell EMC VNX1 Operating Environment (OE) for Block versions prior to 05.32.000.5.225, update to version 05.32.000.5.225 or later. For Dell EMC VNXe3200 Operating Environment (OE), consider disabling the XML parser until a patch is available. For Dell EMC VNXe1600 Operating Environment (OE) versions prior to 3.1.9.9570228, update to version 3.1.9.9570228 or later. For Dell EMC VNXe 3100/3150/3300 Operating Environment (OE), consider disabling the XML parser until a patch is available. For Dell EMC ViPR SRM versions 3.7, 3.7.1, 3.7.2, update to a version later than 3.7.2. For Dell EMC ViPR SRM versions 4.0, 4.0.1, 4.0.2, 4.0.3, update to a version later than 4.0.3. For Dell EMC XtremIO versions 4.x, update to a version later than 4.x. For Dell EMC VMAX eNAS version 8.x, update to a version later than 8.x. For Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968, update to version 4.3.0.1522077968 or later.

Fix

XXE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2018-1183

Affected Products

Dell Emc Smis
Dell Emc Solutions Enabler Virtual Appliance
Dell Emc Unisphere For Vmax Virtual Appliance
Dell Emc Unity Operating Environment
Emc Vasa Provider Virtual Appliance
Dell Emc Vmax Embedded Management
Dell Emc Vmax Enas
Dell Emc Vnx1 Operating Environment (Oe) For Block
Dell Emc Vnx2 Operating Environment (Oe) For Block
Emc Vnxe3100/3150/3300 Operating Environment
Dell Emc Vnxe1600 Operating Environment
Emc Vnxe3200 Operating Environment
Dell Emc Vipr Srm
Dell Emc Xtremio