SB2022102127 - Multiple vulnerabilities in Dell Enterprise Hybrid Cloud
Published: October 21, 2022 Updated: February 6, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Input validation error (CVE-ID: CVE-2021-21972)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input in vSphere Client. A remote non-authenticated attacker can send a specially crafted HTTP request to port 443/tcp and execute arbitrary code on the system.
2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-21973)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in vSphere Client. A remote non-authenticated attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
3) Heap-based buffer overflow (CVE-ID: CVE-2021-21974)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing packets within the OpenSLP service. A remote non-authenticated attacker on the local network can send specially crafted SLP messages to port 427/tcp, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Note, the vulnerability is being actively exploited in the wild.
Remediation
Install update from vendor's website.