variot - var-201812-0039

VAR-201812-0039

Vulnerability from variot - Updated: 2023-12-18 13:23

Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell. Dell EMC iDRAC is prone to the following security vulnerabilities: 1. A privilege-escalation vulnerability 2. A local unauthorized-access vulnerability An attacker can exploit this issue to run processes with elevated privileges, gain unauthorized access and execute arbitrary commands with user privileges in context of the affected application. This solution provides functions such as remote management, crash recovery and power control for Dell PowerEdge systems

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201812-0039",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "idrac7",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "dell",
        "version": "2.61.60.60"
      },
      {
        "model": "idrac8",
        "scope": "lt",
        "trust": 1.8,
        "vendor": "dell",
        "version": "2.61.60.60"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.20.20.20"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.19.19.19"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.18.18.18"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.17.20.17"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.17.18.17"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.17.17.17"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.16.16.16"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.15.19.15"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.15.17.15"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.15.15.15"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.11.11.11"
      },
      {
        "model": "idrac9",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.00.00.00"
      },
      {
        "model": "idrac8",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "0"
      },
      {
        "model": "idrac7",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "0"
      },
      {
        "model": "idrac6",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "dell",
        "version": "0"
      },
      {
        "model": "idrac9",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.23.23.23"
      },
      {
        "model": "idrac9",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.21.26.22"
      },
      {
        "model": "idrac9",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.21.24.22"
      },
      {
        "model": "idrac9",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "dell",
        "version": "3.20.21.20"
      },
      {
        "model": "idrac8",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "dell",
        "version": "2.61.60.60"
      },
      {
        "model": "idrac7",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "dell",
        "version": "2.61.60.60"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "106233"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:dell:idrac7_firmware:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.61.60.60",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:dell:idrac8_firmware:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.61.60.60",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Jon Sands and Adam Nielsen",
    "sources": [
      {
        "db": "BID",
        "id": "106233"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2018-15776",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Local",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 4.6,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "CVE-2018-15776",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 3.9,
            "id": "VHN-126069",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:L/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "PHYSICAL",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 0.9,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "author": "security_alert@emc.com",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 0.5,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Physical",
            "author": "NVD",
            "availabilityImpact": "High",
            "baseScore": 6.8,
            "baseSeverity": "Medium",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "CVE-2018-15776",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2018-15776",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "security_alert@emc.com",
            "id": "CVE-2018-15776",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201812-673",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULHUB",
            "id": "VHN-126069",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2018-15776",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-15776"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell. Dell EMC iDRAC is prone to the following security vulnerabilities:\n1. A privilege-escalation vulnerability\n2. A local unauthorized-access vulnerability\nAn attacker can exploit this issue to run processes with elevated privileges, gain unauthorized access and execute arbitrary commands with user privileges in context of the affected application. This solution provides functions such as remote management, crash recovery and power control for Dell PowerEdge systems",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "BID",
        "id": "106233"
      },
      {
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-15776"
      }
    ],
    "trust": 2.07
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "106233",
        "trust": 2.9
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776",
        "trust": 2.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-15728",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-126069",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-15776",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-15776"
      },
      {
        "db": "BID",
        "id": "106233"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ]
  },
  "id": "VAR-201812-0039",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-126069"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T13:23:51.518000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Dell EMC iDRAC \u306e\u8907\u6570\u306e\u8106\u5f31\u6027 (cve-2018-15774 \u304a\u3088\u3073 cve-2018-15776)",
        "trust": 0.8,
        "url": "https://www.dell.com/support/article/jp/ja/jpdhs1/sln315190/dell-emc-idrac-\u306e\u8907\u6570\u306e\u8106\u5f31\u6027-cve-2018-15774-\u304a\u3088\u3073-cve-2018-15776?lang=ja"
      },
      {
        "title": "Dell EMC iDRAC7  and iDRAC8 Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=87908"
      },
      {
        "title": "reverse-engineering-dell-idrac-to-get-rid-of-gpu-throttling",
        "trust": 0.1,
        "url": "https://github.com/l4rz/reverse-engineering-dell-idrac-to-get-rid-of-gpu-throttling "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/chnzzh/idrac-cve-lib "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2018-15776"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-noinfo",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-388",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.7,
        "url": "http://www.securityfocus.com/bid/106233"
      },
      {
        "trust": 2.1,
        "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15776"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-15776"
      },
      {
        "trust": 0.3,
        "url": "https://www.dellemc.com/en-us/index.htm"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/l4rz/reverse-engineering-dell-idrac-to-get-rid-of-gpu-throttling"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-15776"
      },
      {
        "db": "BID",
        "id": "106233"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "db": "VULMON",
        "id": "CVE-2018-15776"
      },
      {
        "db": "BID",
        "id": "106233"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-12-13T00:00:00",
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "date": "2018-12-13T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-15776"
      },
      {
        "date": "2018-12-13T00:00:00",
        "db": "BID",
        "id": "106233"
      },
      {
        "date": "2019-03-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "date": "2018-12-13T22:29:00.377000",
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "date": "2018-12-14T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-08-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-126069"
      },
      {
        "date": "2020-08-24T00:00:00",
        "db": "VULMON",
        "id": "CVE-2018-15776"
      },
      {
        "date": "2018-12-13T00:00:00",
        "db": "BID",
        "id": "106233"
      },
      {
        "date": "2019-03-11T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      },
      {
        "date": "2020-08-24T17:37:01.140000",
        "db": "NVD",
        "id": "CVE-2018-15776"
      },
      {
        "date": "2020-10-22T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "local",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dell EMC iDRAC7 and  iDRAC8 Error handling vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2018-014039"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "code problem",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201812-673"
      }
    ],
    "trust": 0.6
  }
}

CVE-2018-15776 (GCVE-0-2018-15776)

Vulnerability from cvelistv5 – Published: 2018-12-13 22:00 – Updated: 2024-09-16 22:56

Title

iDRAC7, iDRAC8 - Improper Error Handling

Summary

Severity ?

6.4 (Medium)


                        
                          CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Improper Error Handling Vulnerability.

Assigner

dell

References

URL

Tags

	https://www.dell.com/support/article/us/en/19/sln…	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/106233	vdb-entryx_refsource_BID

Impacted products

	Vendor	Product	Version
	Dell EMC	iDRAC	Affected: iDRAC7 , < 2.61.60.60 (custom) Affected: iDRAC8 , < 2.61.60.60 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:01:54.552Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"
          },
          {
            "name": "106233",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/106233"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iDRAC",
          "vendor": "Dell EMC",
          "versions": [
            {
              "lessThan": "2.61.60.60",
              "status": "affected",
              "version": "iDRAC7",
              "versionType": "custom"
            },
            {
              "lessThan": "2.61.60.60",
              "status": "affected",
              "version": "iDRAC8",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2018-12-11T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Error Handling Vulnerability.",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-12-19T10:57:01",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"
        },
        {
          "name": "106233",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/106233"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "iDRAC7, iDRAC8 - Improper Error Handling",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security_alert@emc.com",
          "DATE_PUBLIC": "2018-12-11T06:00:00.000Z",
          "ID": "CVE-2018-15776",
          "STATE": "PUBLIC",
          "TITLE": "iDRAC7, iDRAC8 - Improper Error Handling"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "iDRAC",
                      "version": {
                        "version_data": [
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "iDRAC7",
                            "version_value": "2.61.60.60"
                          },
                          {
                            "affected": "\u003c",
                            "version_affected": "\u003c",
                            "version_name": "iDRAC8",
                            "version_value": "2.61.60.60"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell EMC"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Dell EMC iDRAC7/iDRAC8 versions prior to 2.61.60.60 contain an improper error handling vulnerability. An unauthenticated attacker with physical access to the system could potentially exploit this vulnerability to get access to the u-boot shell."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Error Handling Vulnerability."
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en",
              "refsource": "CONFIRM",
              "url": "https://www.dell.com/support/article/us/en/19/sln315190/dell-emc-idrac-multiple-vulnerabilities-cve-2018-15774-and-cve-2018-15776-?lang=en"
            },
            {
              "name": "106233",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/106233"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2018-15776",
    "datePublished": "2018-12-13T22:00:00Z",
    "dateReserved": "2018-08-23T00:00:00",
    "dateUpdated": "2024-09-16T22:56:03.854Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-201812-0039

CVE-2018-15776 (GCVE-0-2018-15776)

Tags

Sightings

Nomenclature