SB2022110106 - Multiple vulnerabilities in Dell EMC XtremIO

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) NULL pointer dereference (CVE-ID: CVE-2017-3169)

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a NULL pointer dereference error within mod_ssl module, when third-party modules call ap_hook_process_connection() function during an HTTP request to an HTTPS port. A remote attacker can send a specially crafted HTTP request and crash the affected web server.

2) Authentication bypass (CVE-ID: CVE-2017-3167)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to usage of the ap_get_basic_auth_pw() function by third-party modules outside of the authentication phase. A remote attacker can create a specially crafted HTTP request to vulnerable web server, bypass authentication requirements and gain unauthorized access to otherwise protected information.

Remediation

Install update from vendor's website.

References

• https://www.dell.com/support/kbdoc/en-us/000001836/dsa-2020-103-dell-emc-xtremio-security-update-for-httpd-vulnerabilities