SB20231010104 - Multiple vulnerabilities in Dell PowerScale OneFS

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2023-25536)

The vulnerability allows a local privileged user to execute arbitrary code on the target system.

The vulnerability exists due to exposure of sensitive information to an unauthorized actor. A local privileged user can exploit this vulnerability in certificate management, leading to a potential system takeover.

2) Incorrect default permissions (CVE-ID: CVE-2023-25540)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

3) Resource exhaustion (CVE-ID: CVE-2023-23689)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.dell.com/support/kbdoc/en-us/000209895/dell-emc-powerscale-onefs-security-updates-for-multiple-security