#VU14572 Improper file permission in iDRAC Service Module - CVE-2018-11053

Vulnerability identifier: #VU14572

Vulnerability risk: Low

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-11053

CWE-ID: CWE-276

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
iDRAC Service Module
Web applications / Remote management & hosting panels

Vendor: Dell

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to the software changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A remote attacker can modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content.

Mitigation
Install update from vendor's website.

Vulnerable software versions

iDRAC Service Module: 3.0.1 - 3.2.0

---

External links
https://www.dell.com/support/article/ua/ru/uabsdt1/sln310281/ism-dell-emc-idrac-service-module-impro...

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.