PT-2020-18400 · Dell Emc · Dell Emc Unity+1

Published 2020-02-06 · Updated 2020-02-12 · CVE-2020-5319

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009

Description The issue concerns a Denial of Service vulnerability in the NAS Server SSH implementation used for SFTP service on a NAS server. A remote unauthenticated attacker may exploit this by sending an out of order SSH protocol sequence, potentially causing a Denial of Service, specifically a Storage Processor Panic.

Recommendations For versions prior to 5.0.2.0.5.009, update to version 5.0.2.0.5.009 or later to resolve the issue.

Fix

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2020-5319

Affected Products

Dell Emc Unity

Dell Emc Unityvsa

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-5319 · Security Note
• https://dell.com/support/security/en-us/details/540336/DSA-2020-019-Dell-EMC-Unity-Family-Dell-EMC-Unity-XT-Family-Denial-of-Service-Vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5319 · Vendor Advisory