Dell Dell EMC iDRAC Response to Vulnerabilities Described in CVE-2018-1249 CVE-2018-1244 CVE-2018-1212 CVE-2018-1243 Owner's Manual User Guide

Dell EMC i DRAC Response to Vulnerabilities Described in CVE-2018-1249, CVE-2018-1244, CVE-2018-1212, CVE-2018-1243 [updated 20 Sept 2018]

OVERVIEW

The following is Dell EMC’s response to multiple CVEs in Integrated Dell Remote Access Controller (i DRAC). i DRAC firmware versions listed below contain fixes for these security vulnerabilities that could potentially be exploited by malicious users to compromise the affected system.

CVE Identifiers: CVE-2018-1249 (Medium), CVE-2018-1244 (High), CVE-2018-1212 (High), CVE-2018-1243 (High)

TECHNICAL SUMMARY • CVE-2018-1249: Dell EMC i DRAC9 versions prior to 3.21.21.21 did not enforce the use of TLS/SSL for a connection to i DRAC web server for certain URLs. A man-in-the-middle attacker could use this vulnerability to strip the SSL/TLS protection from a connection between a client and a server. • CVE-2018-1244: Dell EMC i DRAC7/i DRAC8, versions prior to 2.60.60.60, and i DRAC9 versions prior to 3.21.21.21 contain a command injection vulnerability in the SNMP agent. A remote authenticated malicious i DRAC user with configuration privileges could potentially exploit this vulnerability to execute arbitrary commands on the i DRAC where SNMP alerting is enabled. • CVE-2018-1212: The web-based diagnostics console in Dell EMC i DRAC6 (Monolithic versions prior to 2.91 and Modular all versions) contains a command injection vulnerability. A remote authenticated malicious i DRAC user with access to the diagnostics console could potentially exploit this vulnerability to execute arbitrary commands as root on the affected i DRAC system. • CVE-2018-1243: Dell EMC i DRAC6, versions prior to 2.91, i DRAC7/i DRAC8, versions prior to 2.60.60.60 and i DRAC9, versions prior to 3.21.21.21, contain a weak CGI session ID vulnerability. The sessions invoked via CGI binaries use 96-bit numeric-only session ID values, which makes it easier for remote attackers to perform brute-force session guessing attacks.

RESOLUTION The following Dell EMC i DRAC firmware releases contain resolutions to these vulnerabilities: • Dell EMC i DRAC6 version 2.91 for Monolithic servers (CVE-2018-1243 and CVE-2018-1212) • Dell EMC i DRAC7/i DRAC8 version 2.60.60.60 (CVE-2018-1244 and CVE-2018-1243) • Dell EMC i DRAC9 version 3.21.21.21 (CVE-2018-1249, CVE-2018-1244 and CVE-2018-1243)

Dell EMC recommends all customers upgrade at the earliest opportunity. Dell EMC recommends that customers take into account any deployment factors that may be relevant to their environment to assess their overall risk.