SB2021062505 - Multiple vulnerabilities in Dell BIOSConnect and HTTPS Boot features

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Improper certificate validation (CVE-ID: CVE-2021-21571)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation within the Dell BIOSConnect and Dell HTTPS Boot features. A remote attacker can perform MitM attack and cause a denial of service or tamper with the system boot.

2) Buffer overflow (CVE-ID: CVE-2021-21572)

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to a boundary error within Dell BIOSConnect feature. A local user with privileged access to the system can bypass UEFI restrictions and execute arbitrary code.

3) Buffer overflow (CVE-ID: CVE-2021-21573)

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to a boundary error within Dell BIOSConnect feature. A local user with privileged access to the system can bypass UEFI restrictions and execute arbitrary code.

4) Buffer overflow (CVE-ID: CVE-2021-21574)

The vulnerability allows a local user to compromise the affected system.

The vulnerability exists due to a boundary error within Dell BIOSConnect feature. A local user with privileged access to the system can bypass UEFI restrictions and execute arbitrary code.

Remediation

Install update from vendor's website.

References

• https://www.dell.com/support/kbdoc/en-us/000188682