6.5

CVE-2018-11053

iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability

Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dell ≫ Emc Idrac Service Module Version 3.0.1
   Citrix ≫ Xenserver Version 7.1
   Redhat ≫ Enterprise Linux Version 6.9
   Redhat ≫ Enterprise Linux Version 7.4
   Suse ≫ Suse Linux Enterprise Server Version 11 Update sp4
   Suse ≫ Suse Linux Enterprise Server Version 12 Update sp3
Dell ≫ Emc Idrac Service Module Version 3.0.2
   Citrix ≫ Xenserver Version 7.1
   Redhat ≫ Enterprise Linux Version 6.9
   Redhat ≫ Enterprise Linux Version 7.4
   Suse ≫ Suse Linux Enterprise Server Version 11 Update sp4
   Suse ≫ Suse Linux Enterprise Server Version 12 Update sp3
Dell ≫ Emc Idrac Service Module Version 3.1.0
   Citrix ≫ Xenserver Version 7.1
   Redhat ≫ Enterprise Linux Version 6.9
   Redhat ≫ Enterprise Linux Version 7.4
   Suse ≫ Suse Linux Enterprise Server Version 11 Update sp4
   Suse ≫ Suse Linux Enterprise Server Version 12 Update sp3
Dell ≫ Emc Idrac Service Module Version 3.2.0
   Citrix ≫ Xenserver Version 7.1
   Redhat ≫ Enterprise Linux Version 6.9
   Redhat ≫ Enterprise Linux Version 7.4
   Suse ≫ Suse Linux Enterprise Server Version 11 Update sp4
   Suse ≫ Suse Linux Enterprise Server Version 12 Update sp3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.358
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 2.8 3.6
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NIST 4 8 2.9
AV:N/AC:L/Au:S/C:N/I:P/A:N
EMC 6.6 0.8 5.3
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

http://www.dell.com/support/article/us/en/19/sln310281/ism-dell-emc-idrac-service-module-improper-file-permission-vulnerability?lang=en
Patch
Vendor Advisory
http://www.securityfocus.com/bid/104567
Third Party Advisory
VDB Entry