Lucene search

[email protected]CVE-2018-11053

HistoryJun 26, 2018 - 10:29 p.m.

CVE-2018-11053

2018-06-2622:29:00

CWE-732

[email protected]

web.nvd.nist.gov

cve-2018-11053

dell emc

idrac

linux

xenserver

file permissions

security vulnerability

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content.

Affected configurations

NVD

Node

citrixxenserverMatch7.1

redhatenterprise_linuxMatch6.9

redhatenterprise_linuxMatch7.4

susesuse_linux_enterprise_serverMatch11sp4

susesuse_linux_enterprise_serverMatch12sp3

AND

dellemc_idrac_service_moduleMatch3.0.1

dellemc_idrac_service_moduleMatch3.0.2

dellemc_idrac_service_moduleMatch3.1.0

dellemc_idrac_service_moduleMatch3.2.0

CPENameOperatorVersion
dell:emc_idrac_service_moduledell emc idrac service moduleeq3.0.1
dell:emc_idrac_service_moduledell emc idrac service moduleeq3.0.2
dell:emc_idrac_service_moduledell emc idrac service moduleeq3.1.0
dell:emc_idrac_service_moduledell emc idrac service moduleeq3.2.0

CPE	Name	Operator	Version
dell:emc_idrac_service_module	dell emc idrac service module	eq	3.0.1
dell:emc_idrac_service_module	dell emc idrac service module	eq	3.0.2
dell:emc_idrac_service_module	dell emc idrac service module	eq	3.1.0
dell:emc_idrac_service_module	dell emc idrac service module	eq	3.2.0

CNA Affected

[
  {
    "product": "iDRAC Service Module ",
    "vendor": "Dell EMC",
    "versions": [
      {
        "status": "affected",
        "version": "3.0.1"
      },
      {
        "status": "affected",
        "version": "3.0.2"
      },
      {
        "status": "affected",
        "version": "3.1.0"
      },
      {
        "status": "affected",
        "version": "3.2.0"
      }
    ]
  }
]

References

www.dell.com/support/article/us/en/19/sln310281/ism-dell-emc-idrac-service-module-improper-file-permission-vulnerability?lang=en

www.securityfocus.com/bid/104567

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.7%

JSON

Related for CVE-2018-11053

cvelist1 nvd1 prion1