PT-2021-11216 · Dell Emc · Dell Emc Isilon Onefs+1

Published 2021-07-28 · Updated 2021-08-06 · CVE-2020-26180

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell EMC Isilon OneFS versions 8.1 and later Dell EMC PowerScale OneFS version 9.0.0

Description: The issue concerns an access problem with the remotesupport user account, allowing a remote malicious user with low privileges to gain access to data stored on the /ifs directory through most protocols.

Recommendations: For Dell EMC Isilon OneFS versions 8.1 and later, consider restricting access to the remotesupport user account until a fix is available. For Dell EMC PowerScale OneFS version 9.0.0, restrict access to the /ifs directory to minimize the risk of exploitation. As a temporary workaround, consider disabling the remotesupport user account until a patch is available.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2020-26180

Affected Products

Dell Emc Isilon Onefs

Dell Emc Powerscale Onefs

References · 4

• https://dell.com/support/security/en-us/details/546591/DSA-2020-225-Dell-EMC-Isilon-OneFS-and-Dell-EMC-PowerScale-OneFS-Security-Update-for-remotesuppor · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26180 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26180 · Vendor Advisory
• https://t.me/cvenotify/18218 · Telegram Post