DSA-2019-139: Dell ImageAssist Security Update for an Information Disclosure Vulnerability

Dell ImageAssist versions prior to 8.7.15 contain an information disclosure vulnerability. Dell ImageAssist stores some sensitive encrypted information in the images it creates. A privileged user of a system running an operating system that was deployed with Dell ImageAssist could potentially retrieve this sensitive information to then compromise the system and related systems.
CVSS Base Score:  7.5 (AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H)

Affected products: 

Dell ImageAssist versions prior to 8.7.15

 

Remediation:

The following Dell ImageAssist release contains a resolution to the vulnerability:

 

• Dell ImageAssist version 8.7.15

 

Dell recommends all customers upgrade at the earliest opportunity.

IT administrators who created images with Dell ImageAssist prior to 8.7.15 should change any password included in the created image on the deployed systems.

---

General Guidance on Account Security:

1. IT administrators should enforce OS password change at regular intervals.
2. IT administrators should set complex password requirements.
3. Users should not use the same passwords on other systems.
4. Users should use a password manager to make sure they’re using strong, unique passwords everywhere.