PT-2019-16652 · Dell Emc · Idrac9+3

Published 2019-04-26 · Updated 2020-10-16 · CVE-2019-3705

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC6 versions prior to 2.92 Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 Dell EMC iDRAC9 versions prior to 3.20.21.20 Dell EMC iDRAC9 versions prior to 3.21.24.22 Dell EMC iDRAC9 versions prior to 3.21.26.22 Dell EMC iDRAC9 versions prior to 3.23.23.23

Description The issue is a stack-based buffer overflow that can be exploited by an unauthenticated remote attacker. By sending specially crafted input data to the affected system, the attacker may crash the webserver or execute arbitrary code on the system with privileges of the webserver.

Recommendations For Dell EMC iDRAC6 versions prior to 2.92, update to version 2.92 or later. For Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60, update to version 2.61.60.60 or later. For Dell EMC iDRAC9 versions prior to 3.20.21.20, update to version 3.20.21.20 or later. For Dell EMC iDRAC9 versions prior to 3.21.24.22, update to version 3.21.24.22 or later. For Dell EMC iDRAC9 versions prior to 3.21.26.22, update to version 3.21.26.22 or later. For Dell EMC iDRAC9 versions prior to 3.23.23.23, update to version 3.23.23.23 or later.

Fix

Memory Corruption

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-120

Related Identifiers

CVE-2019-3705

Affected Products

Idrac6

Idrac7

Idrac8

Idrac9

References · 3

• https://osv.dev/vulnerability/CVE-2019-3705 · Vendor Advisory
• https://dell.com/support/article/us/en/04/sln316930/dsa-2019-028-dell-emc-idrac-multiple-vulnerabilities?lang=en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3705 · Security Note