PT-2020-6820 · Dell Emc · Idrac7+2

Published 2020-03-31 · Updated 2020-04-03 · CVE-2020-5344

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC iDRAC7 versions prior to 2.65.65.65 Dell EMC iDRAC8 versions prior to 2.70.70.70 Dell EMC iDRAC9 versions prior to 4.00.00.00

Description The issue is caused by a stack-based buffer overflow. An unauthenticated remote attacker may exploit this to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.

Recommendations For Dell EMC iDRAC7 versions prior to 2.65.65.65, update to version 2.65.65.65 or later. For Dell EMC iDRAC8 versions prior to 2.70.70.70, update to version 2.70.70.70 or later. For Dell EMC iDRAC9 versions prior to 4.00.00.00, update to version 4.00.00.00 or later.

Fix

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

BDU:2022-07410

CVE-2020-5344

Affected Products

Idrac7

Idrac8

Idrac9

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-5344 · Security Note
• https://dell.com/support/article/en-us/sln320717/dsa-2020-063-idrac-buffer-overflow-vulnerability?lang=en · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07410 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5344 · Vendor Advisory
• https://dell.com/support/kbdoc/en-uk/000177737/dsa-2020-063-idrac-buffer-overflow-vulnerability · Note
• https://cxsecurity.com/cveshow/CVE-2020-5344 · Note
• https://t.me/cvenotify/2304 · Telegram Post