Multiple vulnerabilities in Dell EMC Cyber Recovery

1) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU17908

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1543

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to encrypted data.

The vulnerability exists due to incorrect implementation of the ChaCha20-Poly1305 cipher. For messages, encrypted with this cipher, a reused nonce value is used that is susceptible to serious confidentiality and integrity attacks. If an application changes the default nonce length to be longer than 12 bytes and then makes a change to the leading bytes of the nonce expecting the new value to be a new unique nonce then such an application could inadvertently encrypt messages with a reused nonce.

This vulnerability does not affect internal usage of the cipher within OpenSSL. However if an application uses this cipher directly and sets a non-default nonce length to be longer than 12 bytes, it may be vulnerable.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) NULL pointer dereference

EUVDB-ID: #VU18060

Risk: Medium

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9937

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dreference error when processing interleaving reads and writes in a single transaction with an fts5 virtual table in fts5ChunkIterate in sqlite3.c. This is related to ext/fts5/fts5_hash.c and ext/fts5/fts5_index.c. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) NULL pointer dereference

EUVDB-ID: #VU11173

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-8740

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists in the build.c and prepare.c source codes files due to NULL pointer dereference. A remote attacker can cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Integer overflow

EUVDB-ID: #VU18024

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3855

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in the _libssh2_transport_read() function in transport.cwhen processing packet_lengthvalues. A remote attacker can trick the victim to connect to a malicious SSH server, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Integer overflow

EUVDB-ID: #VU18023

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3856

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when parsing keyboard prompt requests. A remote attacker can trick the victim to connect to a malicious SSH server, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Integer overflow

EUVDB-ID: #VU18025

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3857

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow when parsing SSH_MSG_CHANNEL_REQUEST packets. A remote attacker can trick the victim to connect to a malicious SSH server, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds read

EUVDB-ID: #VU18028

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3858

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing SFTP packets. A remote attacker can trick the victim to connect to a malicious SSH server, trigger out-of-bounds read error and read contents of memory or crash the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Out-of-bounds read

EUVDB-ID: #VU18027

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3859

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing packets in _libssh2_packet_require() and _libssh2_packet_requirev() functions. A remote attacker can trick the victim to connect to a malicious SSH server, trigger out-of-bounds read error and read contents of memory or crash the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Out-of-bounds read

EUVDB-ID: #VU18026

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3860

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing SFTP packets. A remote attacker can trick the victim to connect to a malicious SSH server, trigger out-of-bounds read error and read contents of memory or crash the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Out-of-bounds read

EUVDB-ID: #VU18252

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3861

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when SSH packets with a padding length value greater than the packet length are parsed. A remote attacker can trick the victim to connect to a malicious SSH server, trigger out of bounds read and gain access to sensitive information or perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Out-of-bounds read

EUVDB-ID: #VU18253

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3862

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information or perform denial of service (DoS) attack.

The vulnerability exists due to a boundary condition when SSH_MSG_CHANNEL_REQUEST packets with an exit status message and no payload are parsed. A remote attacker can trick the victim to connect to a malicious SSH server, trigger out of bounds read and gain access to sensitive information or perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds write

EUVDB-ID: #VU18254

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3863

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing total length of multiple keyboard interactive response messages that exceeds the value of unsigned char max characters. A remote attacker can trick the victim to connect to a malicious SSH server, trigger our of bounds write and execute arbitrary code on the system with privileges of the user, running the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Symlink attack

EUVDB-ID: #VU11185

Risk: Low

CVSSv3.1: 4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-6954

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

Description

The vulnerability allows a local attacker to launch symlink attack on the target system.

The weakness exists in the systemd-tmpfiles feature due to improper handling of symlinks in nonterminal path components. A local attacker can gain unauthorized access to arbitrary files.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

14) SQL injection

EUVDB-ID: #VU17164

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20506

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the SQLite component. A remote attacker can send a specially specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18153

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3842

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to pam_systemd creates a user session using environmental parameters. A local user can spoof an active session and gain additional PolicyKit privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Input validation error

EUVDB-ID: #VU17752

Risk: Low

CVSSv3.1: 5.4 [CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-6454

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local unauthenticated attacker to cause DoS condition on the target system.

The weakness exists due to incorrect handling of certain D-Bus messages. A local attacker can supply specially crafted D-Bus messages to crash the init process, resulting in a system denial-of-service (kernel panic).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU18276

Risk: Medium

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11068

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to an error within the xsltCheckRead() and xsltCheckWrite() functions when processing requests from remote servers. A remote attacker can trick the victim into opening a specially crafted URL that will result in "-1 error" code but the URL itself will be processed by the application later.

Successful exploitation of the vulnerability may allow an attacker to bypass certain security restrictions and perform XXE attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Heap use-after-free

EUVDB-ID: #VU17229

Risk: Low

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-6706

CWE-ID: CWE-416 - Use After Free

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a geap use-after-free error in lua_upvaluejoin in lapi.c. A remote attacker who is able to trigger a debug.upvaluejoin call in which the arguments have certain relationships can cause the service to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

19) Symlink attack

EUVDB-ID: #VU29241

Risk: Medium

CVSSv3.1: 4 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-3902

CWE-ID: CWE-61 - UNIX Symbolic Link (Symlink) Following

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a symlink following issue. A remote user can create a specially crafted symbolic link to and write files outside a repository.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Out-of-bounds read

EUVDB-ID: #VU18801

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11036

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition in exif_process_IFD_TAG() function in PHP EXIF extension. A remote attacker can send a specially crafted file to the affected application, trigger out-of-bounds read error and read contents of memory on the system or crash the process.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) XXE attack

EUVDB-ID: #VU15760

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-14647

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

Description

The vulnerability allows a remote attacker to conduct XXE-attack.

The vulnerability exists due to improper handling of XML External Entities (XXEs) when parsing an XML file. A remote attacker can trick the victim into open an XML file that submits malicious input, trigger pathological hash collisions in Expat's internal data structures, consume large amounts CPU and RAM, and cause a denial of service (DoS) condition.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Input validation error

EUVDB-ID: #VU18355

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9636

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input when processing data in Unicode encoding with an incorrect netloc during NFKC normalization. A remote attacker can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Exposed dangerous method or function

EUVDB-ID: #VU18827

Risk: Medium

CVSSv3.1: 6.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-9948

CWE-ID: CWE-749 - Exposed Dangerous Method or Function

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to urllib implementation in Python 2.x supports the local_file: scheme. An attacker with ability to control input data, such as URL, can bypass protection mechanisms that blacklist file: URIs and view contents of arbitrary file on the system.

PoC:

urllib.urlopen('local_file:///etc/passwd')

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

24) OS Command Injection

EUVDB-ID: #VU31049

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-12735

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: Yes

Description

The vulnerability allows a local non-authenticated attacker to execute arbitrary code.

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assert_fails or nvim_input in Neovim.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

25) Input validation error

EUVDB-ID: #VU18315

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9917

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted message in incorrect encoding and cause the application to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Out-of-bounds read

EUVDB-ID: #VU18059

Risk: Low

CVSSv3.1: 2 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9936

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the fts5HashEntrySort in sqlite3.c when running fts5 prefix queries inside a transaction. A remote user with ability to send queries can trigger heap-based buffer over-read error and read contents of memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) SQL injection

EUVDB-ID: #VU17162

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-20346

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in the SQLite component. A remote attacker can send a specially specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Integer overflow

EUVDB-ID: #VU15671

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-16839

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow in processing the Curl_auth_create_plain_message name and password when handling malicious input. A remote unauthenticated attacker can send specially crafted SASL password data, trigger memory corruption and execute arbitrary code with elevated privileges. The affected function can be invoked using POP3(S), IMAP(S), or SMTP(S).

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Input validation error

EUVDB-ID: #VU21785

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9924

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to "rbash" does not prevent the shell user from modifying BASH_CMDS. A local authenticate user can execute any command with the permissions of the shell.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU32025

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-5743

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

By design, BIND is intended to limit the number of TCP clients that can be connected at any given time. The number of allowed connections is a tunable parameter which, if unset, defaults to a conservative value for most servers. Unfortunately, the code which was intended to limit the number of simultaneous connections contained an error which could be exploited to grow the number of simultaneous connections beyond this limit. Versions affected: BIND 9.9.0 -> 9.10.8-P1, 9.11.0 -> 9.11.6, 9.12.0 -> 9.12.4, 9.14.0. BIND 9 Supported Preview Edition versions 9.9.3-S1 -> 9.11.5-S3, and 9.11.5-S5. Versions 9.13.0 -> 9.13.7 of the 9.13 development branch are also affected. Versions prior to BIND 9.9.0 have not been evaluated for vulnerability to CVE-2018-5743.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Reachable Assertion

EUVDB-ID: #VU31827

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-6467

CWE-ID: CWE-617 - Reachable Assertion

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A programming error in the nxdomain-redirect feature can cause an assertion failure in query.c if the alternate namespace used by nxdomain-redirect is a descendant of a zone that is served locally. The most likely scenario where this might occur is if the server, in addition to performing NXDOMAIN redirection for recursive clients, is also serving a local copy of the root zone or using mirroring to provide the root zone, although other configurations are also possible. Versions affected: BIND 9.12.0-> 9.12.4, 9.14.0. Also affects all releases in the 9.13 development branch.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Improper Authentication

EUVDB-ID: #VU19274

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-12749

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a an attacker to bypass authentication process.

The vulnerability exists due to an error when handling symlinks within the reference implementation of DBUS_COOKIE_SHA1 in the libdbus library. A malicious client with access to to its own home directory can manipulate a ~/.dbus-keyrings symlink to cause a DBusServer with a different uid to read and write into unintended locations.

Successful exploitation of the vulnerability may allow an attacker to bypass DBUS_COOKIE_SHA1 authentication mechanis.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) NULL pointer dereference

EUVDB-ID: #VU18399

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11494

CWE-ID: CWE-476 - NULL Pointer Dereference

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within Submission-login when processing authentication. A remote attacker can unexpectedly abort the authentication process by disconnecting from the server during authentication and cause the software to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Resource management error

EUVDB-ID: #VU18400

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11499

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to incorrect resource management error within the submission-login when processing incorrect authentication messages over TLS secure channel. A remote attacker can send an invalid authentication message and crash the service.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improper Authentication

EUVDB-ID: #VU18335

Risk: Medium

CVSSv3.1: 6.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-11234

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error related to processing authentication tokens. A remote attacker can execute a reflection attack and bypass authentication process.

This vulnerability was dubbed "Dragonblood".

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

36) Improper Authentication

EUVDB-ID: #VU18336

Risk: Medium

CVSSv3.1: 6.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-11235

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to FreeRadius mishandles secure checks when preforming user authentication process. The related checks refer to mechanisms, which ensures that "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used". A remote attacker can bypass authentication process.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

37) Race condition

EUVDB-ID: #VU31115

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11190

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Exploit availability: No

Description

The vulnerability allows a local authenticated user to gain access to sensitive information.

The Linux kernel before 4.8 allows local users to bypass ASLR on setuid programs (such as /bin/su) because install_exec_creds() is called too late in load_elf_binary() in fs/binfmt_elf.c, and thus the ptrace_may_access() check has a race condition when reading /proc/pid/stat.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

38) Heap-based buffer overflow

EUVDB-ID: #VU18582

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-5436

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing responses from TFTP server in the tftp_receive_packet() function. A remote attacker can trick the victim to send a request to a malicious TFTP server, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

39) Out-of-bounds read

EUVDB-ID: #VU18657

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-8457

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform denial of service attack.

The vulnerability exists due to a boundary condition in rtreenode() function when handling invalid rtree tables. A remote attacker can send a specially crafted request to the application, trigger heap out-of-bounds read crash the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

40) Input validation error

EUVDB-ID: #VU18960

Risk: Low

CVSSv3.1: 5 [CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-13685

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the "dump_callback" function. A local user can submit malicious input and cause a denial of service (DoS) condition on a targeted system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

41) XML External Entity injection

EUVDB-ID: #VU18923

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-20843

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input including XML names that contain a large number of colons. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

42) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU15707

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10844

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to usage of an insecure implementation of HMAC-SHA-256 algorithm vulnerable to a Lucky thirteen style attack. A remote attacker with ability to intercept traffic can recover encrypted data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

43) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU15708

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10845

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to usage of an insecure implementation of HMAC-SHA-384 algorithm vulnerable to a Lucky thirteen style attack. A remote attacker with ability to intercept traffic can recover encrypted data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

44) Cryptographic issues

EUVDB-ID: #VU15709

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-10846

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a cache-based side channel in GnuTLS implementation that can lead to recovery of data in cross-VM attack setting. A remote attacker with ability to intercept traffic can recover encrypted data using a combination of "Just in Time" Prime+probe attack in combination with Lucky-13 attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

45) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU17860

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-1559

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to decrypt sensitive information.

The vulnerability exists due to the way an application behaves, when it receives a 0-byte record with invalid padding compared to the record with an invalid MAC, which results in padding oracle. A remote attacker can decrypt data.

Successful exploitation of the vulnerability requires that the application is using "non-stitched" ciphersuites and calls SSL_shutdown() twice (first, via a BAD_RECORD_MAC and again via a CLOSE_NOTIFY).

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

46) Incorrect calculation

EUVDB-ID: #VU18322

Risk: Low

CVSSv3.1: 3.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-9893

CWE-ID: CWE-682 - Incorrect Calculation

Exploit availability: No

Description

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to incorrect 64-bit syscall argument comparison when using arithmetic operators, such as LT, GT, LE, or GE. A local user can bypass seccomp filters and gain elevated privileges on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

47) Out-of-bounds read

EUVDB-ID: #VU16205

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-19758

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to heap-based buffer overread condition in the wav_write_headerfunction, as defined in the wav.c source code file. A remote attacker can trick the victim into following a custom link or opening a crafted audio file that submits malicious input, trigger memory corruption and perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

48) Resource management error

EUVDB-ID: #VU20866

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6153

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack or gain access to sensitive information.

The vulnerability exists due to the application improperly implements the temporary directory search algorithm. A local user can make the application use the current working directory for storing temporary files and gain access to sensitive information or perform denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

49) Buffer overflow

EUVDB-ID: #VU6582

Risk: High

CVSSv3.1: 8.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2518

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to buffer overflow when processing SQL queries. A remote attacker can send specially crafted SQL queries, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to gain complete control over affected system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

50) Memory corruption

EUVDB-ID: #VU6585

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2519

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when processing SQL queries. A remote attacker can send specially crafted SQL queries, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to gain complete control over affected system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

51) Buffer overflow

EUVDB-ID: #VU6584

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-2520

CWE-ID: CWE-120 - Buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to buffer overflow when processing SQL queries. A remote attacker can send specially crafted SQL queries, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may allow an attacker to gain complete control over affected system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

52) Heap-based buffer overflow

EUVDB-ID: #VU18574

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10989

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a local user to crash the application or gain access to sensitive data.

The vulnerability exists due to a boundary error in the getNodeSize() function in ext/rtree/rtree.c when handling undersized RTree blobs. A local user can supply a specially crafted database to the affected application, trigger heap-based out of bounds read and crash the application or gain access to sensitive data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Dell PowerProtect Cyber Recovery: before 18.1.1.2-8

CPE2.3

External links

http://www.dell.com/support/kbdoc/en-us/000153690/dsa-2019-121-dell-emc-cyber-recovery-security-update-for-multiple-third-party-components-vulnerabilities

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	52
CVE-ID	CVE-2019-1543 CVE-2019-9937 CVE-2018-8740 CVE-2019-3855 CVE-2019-3856 CVE-2019-3857 CVE-2019-3858 CVE-2019-3859 CVE-2019-3860 CVE-2019-3861 CVE-2019-3862 CVE-2019-3863 CVE-2018-6954 CVE-2018-20506 CVE-2019-3842 CVE-2019-6454 CVE-2019-11068 CVE-2019-6706 CVE-2019-3902 CVE-2019-11036 CVE-2018-14647 CVE-2019-9636 CVE-2019-9948 CVE-2019-12735 CVE-2019-9917 CVE-2019-9936 CVE-2018-20346 CVE-2018-16839 CVE-2019-9924 CVE-2018-5743 CVE-2019-6467 CVE-2019-12749 CVE-2019-11494 CVE-2019-11499 CVE-2019-11234 CVE-2019-11235 CVE-2019-11190 CVE-2019-5436 CVE-2019-8457 CVE-2017-13685 CVE-2018-20843 CVE-2018-10844 CVE-2018-10845 CVE-2018-10846 CVE-2019-1559 CVE-2019-9893 CVE-2018-19758 CVE-2016-6153 CVE-2017-2518 CVE-2017-2519 CVE-2017-2520 CVE-2017-10989
CWE-ID	CWE-327 CWE-476 CWE-190 CWE-125 CWE-787 CWE-61 CWE-89 CWE-264 CWE-20 CWE-416 CWE-611 CWE-749 CWE-78 CWE-770 CWE-617 CWE-287 CWE-399 CWE-362 CWE-122 CWE-310 CWE-682 CWE-120 CWE-119
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #13 is available. Public exploit code for vulnerability #18 is available. Public exploit code for vulnerability #23 is available. Public exploit code for vulnerability #24 is available. Public exploit code for vulnerability #35 is available. Public exploit code for vulnerability #36 is available. Public exploit code for vulnerability #40 is available. Public exploit code for vulnerability #41 is available. Public exploit code for vulnerability #47 is available.
Vulnerable software Subscribe	Dell PowerProtect Cyber Recovery Other software / Other software solutions
Vendor	Dell