Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Enjoy members-only rewards and discounts
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Dell Financial Services Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Carts

Article Number: 000131169

DSA-2020-113: Dell Encryption and Dell Endpoint Security Suite Improper Access Control Vulnerability

Summary: Dell Encryption and Dell Endpoint Security Suite require an update to address an improper access control vulnerability.

Article Content

Impact

Medium

Details

  • Improper Access Control Vulnerability
CVE-2020-5358

Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability due to incorrect permissions. A local malicious user with low privileges could potentially exploit this vulnerability to gain elevated privilege on the affected system with the help of a symbolic link.

CVSS Base Score: 6.7 (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
  • Improper Access Control Vulnerability
CVE-2020-5358

Dell Encryption versions prior to 10.7 and Dell Endpoint Security Suite versions prior to 2.7 contain a privilege escalation vulnerability due to incorrect permissions. A local malicious user with low privileges could potentially exploit this vulnerability to gain elevated privilege on the affected system with the help of a symbolic link.

CVSS Base Score: 6.7 (AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products and Remediation

Affected Products:

Dell Encryption prior to 10.7

Dell Endpoint Security Suite prior to 2.7
 

Remediation:

The following Dell Data Security releases contain a resolution to this vulnerability:

 

  • Dell Encryption version 10.7 or later
  • Dell Endpoint Security Suite 2.7 or later

 

Customers should use the latest version from Dell. Dell recommends installing the most current version of Dell Encryption to receive the latest security updates to the product.

 

Customers can download the latest Dell Encryption software here.

 

Dell Endpoint Security Suite Enterprise software will be made available to customers on their ddpe.credant.com accounts or can be obtained through Dell ProSupport.

Affected Products:

Dell Encryption prior to 10.7

Dell Endpoint Security Suite prior to 2.7
 

Remediation:

The following Dell Data Security releases contain a resolution to this vulnerability:

 

  • Dell Encryption version 10.7 or later
  • Dell Endpoint Security Suite 2.7 or later

 

Customers should use the latest version from Dell. Dell recommends installing the most current version of Dell Encryption to receive the latest security updates to the product.

 

Customers can download the latest Dell Encryption software here.

 

Dell Endpoint Security Suite Enterprise software will be made available to customers on their ddpe.credant.com accounts or can be obtained through Dell ProSupport.

Acknowledgements

Dell would like to thank Hou JingYi (hjy79425575) of Qihoo 360 CERT for reporting this issue.

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Information

Article Properties

Affected Product

Security, Dell Encryption, Dell Endpoint Security Suite Enterprise

Last Published Date

10 Nov 2021

Article Type

Dell Security Advisory

Back to Top