Artikelnummer: 000224860
DSA-2024-163: Security Update for Dell PowerScale OneFS for Multiple Security Vulnerabilities
Samenvatting: Dell PowerScale OneFS remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.
Article content
Impact
Medium
Gegevens
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-25967 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVE-2024-25970 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CVE-2024-25969 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVE-2024-25965 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. | 6.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H |
| CVE-2024-25968 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2024-25966 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| Proprietary Code CVEs | Description | CVSS Base Score | CVSS Vector String |
|---|---|---|---|
| CVE-2024-25967 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an execution with unnecessary privileges vulnerability. A local high privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges. | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| CVE-2024-25970 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an improper input validation vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to loss of integrity. | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CVE-2024-25969 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.1 contains an allocation of resources without limits or throttling vulnerability. A local unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 6.2 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CVE-2024-25965 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an external control of file name or path vulnerability. A local high privilege attacker could potentially exploit this vulnerability, leading to denial of service. | 6.1 | CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:H |
| CVE-2024-25968 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains a use of a broken or risky cryptographic algorithm vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure. | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CVE-2024-25966 | Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 contains an improper handling of unexpected data type vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to denial of service. | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
Getroffen producten en herstel
| CVEs Addressed | Product | Affected Version | Remediated Version | Link |
|---|---|---|---|---|
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 8.2.x through 9.3.0.0 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.4.0.18 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.5.0.0 through 9.5.0.7 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.6.0.x through 9.7.0.1 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.7.0.2 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVEs Addressed | Product | Affected Version | Remediated Version | Link |
|---|---|---|---|---|
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 8.2.x through 9.3.0.0 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25966 | PowerScale OneFS | Version 9.4.0.0 through 9.4.0.17 | Version 9.4.0.18 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.5.0.0 through 9.5.0.7 | Version 9.5.0.8 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25967, CVE-2024-25970, CVE-2024-25969, CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.6.0.x through 9.7.0.1 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
| CVE-2024-25965, CVE-2024-25968, CVE-2024-25966 | PowerScale OneFS | Version 9.7.0.2 | Version 9.7.0.3 or later | PowerScale OneFS Downloads Area |
Note: Any version not listed in the Affected Products and Remediation section should upgrade PowerScale OneFS to a version 9.5.0.8 or later.
Note: We encourage all customers to adopt the LTS 2023 version which is 9.5.x code line, with the latest maintenance RUP 9.5.0.8 For more information on LTS (Long Term Support) code lines, see Dell Infrastructure Solutions Group (ISG) LTS Release Support Customer Summary
Tijdelijke oplossingen en beperkingen
| CVE | Workaround |
|---|---|
| CVE-2024-25966 | This vulnerability can be mitigated on PowerScale OneFS by disabling the SMB1. Refer section Disable SMB1 in the below document to disable the SMB1 manually. PowerScale OneFS 9.5.0.0 Security Configuration Guide |
Revisiegeschiedenis
| Revision | Date | Description |
|---|---|---|
| 1.0 | 2024-05-07 | Initial Release |
Verwante informatie
Juridische informatie
Artikeleigenschappen
Datum laatst gepubliceerd
07 mei 2024
Artikeltype
Dell Security Advisory