Medium
Summary:
Dell EMC Isilon OneFS and Dell EMC PowerScale OneFS contain a remediation for a security vulnerability that may be exploited by attackers to compromise the affected system.
Buffer Overflow Vulnerability
Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise component. A remote unauthenticated malicious attacker may potentially exploit this vulnerability to cause a process restart.
CVSS v3.1 Base Score: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Buffer Overflow Vulnerability
Dell EMC Isilon OneFS version 8.2.2 and Dell EMC PowerScale OneFS version 9.0.0 contains a buffer overflow vulnerability in the Likewise component. A remote unauthenticated malicious attacker may potentially exploit this vulnerability to cause a process restart.
CVSS v3.1 Base Score: 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products:
Dell EMC Isilon OneFS version 8.2.2
Dell EMC PowerScale OneFS version 9.0.0
Resolution:
For Dell EMC PowerScale OneFS version 9.0.0, the fix for this issue is included with the August 2020 Roll-up Patch, as well as all future Roll-up Patches. For more information and to obtain a Roll-up patch, see the Current Isilon OneFS Patches document.
For Dell EMC Isilon OneFS version 8.2.2, the fix for this issue is included with the August Roll-up Patch, as well as all future Roll-up Patches. For more information and to obtain a Roll-up patch, see the Current Isilon OneFS Patches document.
Dell EMC recommends all customers upgrade at the earliest opportunity.
Workaround:
Stop SMB as a service by running command:
isi services smb disable
Note: This step should only be done if SMB is not one of the protocols used in the cluster.
Affected products:
Dell EMC Isilon OneFS version 8.2.2
Dell EMC PowerScale OneFS version 9.0.0
Resolution:
For Dell EMC PowerScale OneFS version 9.0.0, the fix for this issue is included with the August 2020 Roll-up Patch, as well as all future Roll-up Patches. For more information and to obtain a Roll-up patch, see the Current Isilon OneFS Patches document.
For Dell EMC Isilon OneFS version 8.2.2, the fix for this issue is included with the August Roll-up Patch, as well as all future Roll-up Patches. For more information and to obtain a Roll-up patch, see the Current Isilon OneFS Patches document.
Dell EMC recommends all customers upgrade at the earliest opportunity.
Workaround:
Stop SMB as a service by running command:
isi services smb disable
Note: This step should only be done if SMB is not one of the protocols used in the cluster.
Dell would like to thank Andre Protas with Apple Information Security for reporting this issue.