Lucene search

DellCVE-2020-5344

HistoryMar 31, 2020 - 10:15 p.m.

CVE-2020-5344

2020-03-3122:15:14

CWE-787

CWE-121

dell

web.nvd.nist.gov

119

dell emc

idrac7

idrac8

idrac9

cve-2020-5344

vulnerability

buffer overflow

remote attacker

arbitrary code

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.01

Percentile

83.4%

JSON

Dell EMC iDRAC7, iDRAC8 and iDRAC9 versions prior to 2.65.65.65, 2.70.70.70, 4.00.00.00 contain a stack-based buffer overflow vulnerability. An unauthenticated remote attacker may exploit this vulnerability to crash the affected process or execute arbitrary code on the system by sending specially crafted input data.

Affected configurations

Nvd

Vulners

Node

dellidrac7_firmwareRange<2.65.65.65

AND

dellidrac7Match-

Node

dellidrac8_firmwareRange<2.70.70.70

AND

dellidrac8Match-

Node

dellidrac9_firmwareRange<4.00.00.00

AND

dellidrac9Match-

VendorProductVersionCPE
dellidrac7_firmware*cpe:2.3:o:dell:idrac7_firmware:*:*:*:*:*:*:*:*
dellidrac7-cpe:2.3:h:dell:idrac7:-:*:*:*:*:*:*:*
dellidrac8_firmware*cpe:2.3:o:dell:idrac8_firmware:*:*:*:*:*:*:*:*
dellidrac8-cpe:2.3:h:dell:idrac8:-:*:*:*:*:*:*:*
dellidrac9_firmware*cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*
dellidrac9-cpe:2.3:h:dell:idrac9:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
dell	idrac7_firmware	*	cpe:2.3:o:dell:idrac7_firmware::::::::
dell	idrac7	-	cpe:2.3:h:dell:idrac7:-:::::::*
dell	idrac8_firmware	*	cpe:2.3:o:dell:idrac8_firmware::::::::
dell	idrac8	-	cpe:2.3:h:dell:idrac8:-:::::::*
dell	idrac9_firmware	*	cpe:2.3:o:dell:idrac9_firmware::::::::
dell	idrac9	-	cpe:2.3:h:dell:idrac9:-:::::::*

CNA Affected

[
  {
    "product": "Integrated Dell Remote Access Controller (iDRAC)",
    "vendor": "Dell",
    "versions": [
      {
        "lessThan": "2.65.65.65",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.dell.com/support/article/en-us/sln320717/dsa-2020-063-idrac-buffer-overflow-vulnerability?lang=en

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.01

Percentile

83.4%

JSON

Related for CVE-2020-5344