Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Dell iDRAC 6 and iDRAC 7 are vulnerable to a cross-site scripting (XSS) attack
Informations
Name VU#920038 First vendor Publication 2013-09-23
Vendor VU-CERT Last vendor Modification 2013-09-24
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#920038

Dell iDRAC 6 and iDRAC 7 are vulnerable to a cross-site scripting (XSS) attack

Original Release date: 23 Sep 2013 | Last revised: 24 Sep 2013

Overview

Dell iDRAC 6 version 1.41, Dell iDRAC 7 version 1.40.40 and possibly earlier versions contain a reflected cross-site scripting (XSS) (CWE-79) vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Dell iDRAC 6 version 1.41 and Dell iDRAC 7 version 1.40.40's administrative web interface login page can allow remote attackers to inject arbitrary script via the vulnerable query string parameter ErrorMsg.

Impact

A remote unauthenticated attacker may be able to execute arbitrary script in the context of the user's browser.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds.

Apply an Update

Firmware updates will be posted to the Dell support page when available. Users should download the appropriate update for the version of iDRAC they have installed:

  • iDRAC6 “monolithic” (rack and towers) – FW version 1.96; targeted release date is Q4CY13.
  • iDRAC7 all models – FW version 1.46.45; target release date is mid/late September 2013.
  • NOTE: iDRAC6 “modular” (blades) are not affected; no updates are required.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the Dell iDRAC web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Dell Computer Corporation, Inc.Affected01 Jul 201323 Sep 2013
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

GroupScoreVector
Base8.5AV:N/AC:L/Au:N/C:P/I:C/A:N
Temporal7.7E:F/RL:W/RC:ND
Environmental1.9CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

  • http://cwe.mitre.org/data/definitions/79.html
  • http://en.community.dell.com/techcenter/systems-management/w/wiki/4357.idrac6-home.aspx
  • http://www.dell.com/learn/us/en/555/solutions/integrated-dell-remote-access-controller-idrac
  • http://support.dell.com/

Credit

Thanks to Tudor Enache of Help AG Middle East for reporting this vulnerability.

This document was written by Adam Rauf.

Other Information

  • CVE IDs:CVE-2013-3589
  • Date Public:23 Sep 2013
  • Date First Published:23 Sep 2013
  • Date Last Updated:24 Sep 2013
  • Document Revision:23

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Original Source

Url : http://www.kb.cert.org/vuls/id/920038

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Hardware 1
Hardware 1
Os 10
Os 8

Nessus® Vulnerability Scanner

Date Description
2013-10-13 Name : The remote device is affected by a cross-site scripting vulnerability.
File : drac_errormsg_xss.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
Date Informations
2014-02-17 12:08:16
  • Multiple Updates
2013-09-25 00:18:35
  • Multiple Updates
2013-09-24 21:23:26
  • Multiple Updates
2013-09-24 17:22:56
  • Multiple Updates
2013-09-23 21:18:45
  • Multiple Updates
2013-09-23 17:19:31
  • First insertion