PT-2018-11045 · Dell Emc · Dell Emc Integrated Data Protection Appliance+1

Slidingwindow · Published 2018-04-09 · Updated 2019-10-03 · CVE-2018-1217

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Avamar Server versions 7.3.1 through 7.5.0 Dell EMC Integrated Data Protection Appliance versions 2.0 through 2.1

Description The issue is related to a missing access control check, which could allow a remote unauthenticated attacker to read or change the Local Download Service (LDLS) credentials. These credentials are used to connect to Dell EMC Online Support. An attacker could also use the credentials to login to Dell EMC Online Support, potentially impersonating the AVI service actions.

Recommendations For Dell EMC Avamar Server versions 7.3.1 through 7.5.0, update the Avamar Installation Manager to a version that includes the missing access control check. For Dell EMC Integrated Data Protection Appliance versions 2.0 through 2.1, update the appliance to a version that includes the missing access control check. As a temporary workaround, consider restricting access to the LDLS credentials to minimize the risk of exploitation.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2018-1217

Affected Products

Dell Emc Avamar Server

Dell Emc Integrated Data Protection Appliance

References · 5

• 🔥 https://exploit-db.com/exploits/44441 · Exploit
• https://osv.dev/vulnerability/CVE-2018-1217 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1217 · Security Note
• http://seclists.org/fulldisclosure/2018/Apr/14 · Note
• http://securitytracker.com/id/1040641 · Note