Sign-up

ID

VAR-201810-0110


CVE

CVE-2018-15765


TITLE

Dell EMC Secure Remote Services Vulnerable to information disclosure

Trust: 0.8

sources: JVNDB: JVNDB-2018-012387

DESCRIPTION

Dell EMC Secure Remote Services, versions prior to 3.32.00.08, contains an Information Exposure vulnerability. The log file contents store sensitive data including executed commands to generate authentication tokens which may prove useful to an attacker for crafting malicious authentication tokens for querying the application and subsequent attacks. Dell EMC ESRS virtual edition is prone to the following multiple security vulnerabilities. 1. An insecure file permission vulnerability 2. A plaintext password storage vulnerability 3. A information disclosure vulnerability Successfully exploiting this issue can allow an attacker to obtain sensitive information , to bypass certain security restrictions to perform unauthorized actions and use the sensitive data available that may aid in launching further attacks. This software is used to provide remote connection between EMC customer service and user's EMC products and solutions. An attacker could exploit this vulnerability to obtain information. Details: 1. The application contains multiple configuration files with world-readable permissions that could allow an authenticated malicious user to utilize the file contents to potentially elevate their privileges. CVSSv3 Base Score: 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) 2. Database credentials are stored in plaintext in a configuration file. An authenticated malicious user with access to the configuration file may obtain the exposed password to gain access to the application database. CVSSv3 Base Score: 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) 3. Severity Rating For an explanation of Severity Ratings, refer to Dell EMC Knowledgebase article 468307 (https://support.emc.com/kb/468307). Dell EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability. Legal Information Read and use the information in this Dell EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this advisory, contact Dell EMC Technical Support (https://support.emc.com/servicecenter/contactEMC/). The information set forth herein is provided "as is" without warranty of any kind. Dell EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall Dell EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of bus iness profits or special damages, even if Dell EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply. Dell Product Security Incident Response Team secure@dell.com<mailto:secure@dell.com> -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEP5nobPoCj3pTvhAZgSlofD2Yi6cFAlvEhxEACgkQgSlofD2Y i6dKYQ//cRY70VtXrzbeCc/8y3ManHY8OoDga3nxgLHqs1NuBoCME4Fe1KGUPg1R j4Wxi5IXo/ZAjPxmzTZgXfs2i3KdhVFt/mYyV2qGjn2ciH6XKkEa/8MUMeEWC4p+ 6/OIdleuxie/vXH+K772gTfM477E6nKFV9G79/SKulFD+i6bkHqxmtU22aj5/V+t Cd895DDQngNMtx853euh9OuP4xMw/neEeNmcu+WSVtfoDCB0XEWPp/upExCre/2/ ThFU1bx8PP15FhzeQNzzMZHpVLPB0qG3sbFwCVsMxnpgF8PqTEaRSudi9WTZVdWw c7hKhO3nzlPYNE+br6T02d8z0CjuDc3NVW4FPt7gfKO1bkBVEvq/4MwwesBARhV1 4FUiQ1YaxC/GHTkjBhNQcy+2KpohMZEprwPY7nT2S75YLXhGs50vAPDbnzhZ+dmk EJgp4DGxwDM1sPx8HVwvqrc6R5lk+ZaULEKSmBei2bXYbcXLEEjIZYtPbEcjMHfs Uz7aRkOaG/G+Z104mkPH1mtQpnotOu0icfyOOiRtRrJW/7dcUVOdK7DqbAUwW7mA o/UwkcVJmUfz0f5Wdjv/vSBu2KgHP7QymXU57e3Lp8TOaSwK9405KVJhpXXLutPf cUQEyqIwlBw8WU5o8rm6kNWBGRfKpFF6DjU4q+9D0TSrN28N/Kk= =vLNR -----END PGP SIGNATURE-----

Trust: 2.07

sources: NVD: CVE-2018-15765 // JVNDB: JVNDB-2018-012387 // BID: 105694 // VULHUB: VHN-126057 // PACKETSTORM: 149840

AFFECTED PRODUCTS

vendor:dellmodel:emc secure remote servicesscope:ltversion:3.32.00.08

Trust: 1.0

vendor:dell emc old emcmodel:secure remote servicesscope:ltversion:3.32.00.08

Trust: 0.8

vendor:dellmodel:esrs virtual editionscope:eqversion:3.28

Trust: 0.3

vendor:dellmodel:esrs virtual editionscope:eqversion:3.24

Trust: 0.3

vendor:dellmodel:esrs virtual editionscope:eqversion:3.10

Trust: 0.3

vendor:dellmodel:esrs virtual editionscope:eqversion:3.08

Trust: 0.3

vendor:dellmodel:esrs virtual editionscope:neversion:3.32.00.08

Trust: 0.3

sources: BID: 105694 // JVNDB: JVNDB-2018-012387 // NVD: CVE-2018-15765

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15765
value: MEDIUM

Trust: 1.0

security_alert@emc.com: CVE-2018-15765
value: LOW

Trust: 1.0

NVD: CVE-2018-15765
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201810-1053
value: MEDIUM

Trust: 0.6

VULHUB: VHN-126057
value: LOW

Trust: 0.1

nvd@nist.gov: CVE-2018-15765
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-126057
severity: LOW
baseScore: 2.1
vectorString: AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15765
baseSeverity: MEDIUM
baseScore: 5.5
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 3.6
version: 3.0

Trust: 1.8

security_alert@emc.com: CVE-2018-15765
baseSeverity: LOW
baseScore: 3.4
vectorString: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 0.8
impactScore: 2.5
version: 3.0

Trust: 1.0

sources: VULHUB: VHN-126057 // JVNDB: JVNDB-2018-012387 // CNNVD: CNNVD-201810-1053 // NVD: CVE-2018-15765 // NVD: CVE-2018-15765

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-126057 // JVNDB: JVNDB-2018-012387 // NVD: CVE-2018-15765

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201810-1053

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201810-1053

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-012387

PATCH
title:Top Pageurl:https://www.dellemc.com/en-us/index.htm
Trust: 0.8
title:Dell EMC Secure Remote Services Repair measures for information disclosure vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86202
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2018-012387 // 
            
            
            
            CNNVD: CNNVD-201810-1053

EXTERNAL IDS
db:NVDid:CVE-2018-15765
Trust: 2.9
db:BIDid:105694
Trust: 2.0
db:SECTRACKid:1041877
Trust: 1.7
db:JVNDBid:JVNDB-2018-012387
Trust: 0.8
db:CNNVDid:CNNVD-201810-1053
Trust: 0.7
db:VULHUBid:VHN-126057
Trust: 0.1
db:PACKETSTORMid:149840
Trust: 0.1
sources:
            
            
            VULHUB: VHN-126057 // 
            
            
            
            BID: 105694 // 
            
            
            
            JVNDB: JVNDB-2018-012387 // 
            
            
            
            PACKETSTORM: 149840 // 
            
            
            
            CNNVD: CNNVD-201810-1053 // 
            
            
            
            NVD: CVE-2018-15765

REFERENCES
url:https://seclists.org/fulldisclosure/2018/oct/35
Trust: 2.8
url:http://www.securityfocus.com/bid/105694
Trust: 1.7
url:http://www.securitytracker.com/id/1041877
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2018-15765
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15765
Trust: 0.8
url:http://dell.com
Trust: 0.3
url:https://support.emc.com/servicecenter/contactemc/).
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-11080
Trust: 0.1
url:https://support.emc.com/kb/468307).
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-11079
Trust: 0.1
sources:
            
            
            VULHUB: VHN-126057 // 
            
            
            
            BID: 105694 // 
            
            
            
            JVNDB: JVNDB-2018-012387 // 
            
            
            
            PACKETSTORM: 149840 // 
            
            
            
            CNNVD: CNNVD-201810-1053 // 
            
            
            
            NVD: CVE-2018-15765

CREDITS
Dell
Trust: 0.3
sources:
            
            
            BID: 105694

SOURCES
db:VULHUBid:VHN-126057
db:BIDid:105694
db:JVNDBid:JVNDB-2018-012387
db:PACKETSTORMid:149840
db:CNNVDid:CNNVD-201810-1053
db:NVDid:CVE-2018-15765

LAST UPDATE DATE
2024-11-23T22:48:33.521000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-126057date:2019-10-09T00:00:00
db:BIDid:105694date:2018-10-15T00:00:00
db:JVNDBid:JVNDB-2018-012387date:2019-02-01T00:00:00
db:CNNVDid:CNNVD-201810-1053date:2019-10-17T00:00:00
db:NVDid:CVE-2018-15765date:2024-11-21T03:51:25.700

SOURCES RELEASE DATE
db:VULHUBid:VHN-126057date:2018-10-18T00:00:00
db:BIDid:105694date:2018-10-15T00:00:00
db:JVNDBid:JVNDB-2018-012387date:2019-02-01T00:00:00
db:PACKETSTORMid:149840date:2018-10-17T15:51:32
db:CNNVDid:CNNVD-201810-1053date:2018-10-19T00:00:00
db:NVDid:CVE-2018-15765date:2018-10-18T22:29:00.630