Date: Fri, 14 Sep 2018 14:09:30 +0000
From: <secure@...l.com>
To: <fulldisclosure@...lists.org>
Subject: [FD] DSA-2018-147: Dell EMC Isilon OneFS and IsilonSD Edge Remote
 Process Crash Vulnerability

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

DSA-2018-147: Dell EMC Isilon OneFS and IsilonSD Edge Remote Process Crash Vulnerability   

Dell EMC Identifier: DSA-2018-147

CVE Identifier: CVE-2018-11071

Severity: High

Severity Rating: CVSS v3 Base Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products:
Dell EMC Isilon OneFS 7.1.1.x
Dell EMC Isilon OneFS 7.2.1.x
Dell EMC Isilon OneFS 8.0.0.x
Dell EMC Isilon OneFS 8.0.1.x
Dell EMC Isilon OneFS 8.1.0.x
Dell EMC Isilon OneFS 8.1.x prior to 8.1.2 
Dell EMC IsilonSD Edge 8.0.0.x
Dell EMC IsilonSD Edge 8.0.1.x
Dell EMC IsilonSD Edge 8.1.0.x 
Dell EMC IsilonSD Edge 8.1.x prior to 8.1.2

Summary:  
Dell EMC Isilon OneFS and Dell EMC IsilonSD Edge require a security update to address a remote process crash vulnerability.   

Details:  
Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 8.1.0.x and 8.1.x prior to 8.1.2 contain a remote process crash vulnerability.  An unauthenticated remote attacker may potentially exploit this vulnerability to crash the isi_drive_d process by sending specially crafted input data to the affected system. This process will then be restarted.

Resolution:  
The following release contains a resolution to this vulnerability:
*	Dell EMC Isilon OneFS versions 8.1.2 and later
*	Dell EMC IsilonSD Edge versions 8.1.2 and later


Dell EMC recommends all customers upgrade at the earliest opportunity. Contact Dell EMC Isilon OneFS   customer support to download the required rpm file and install it. 

Link to remedies:
Registered EMC Online Support customers can download OneFS installation files from the Downloads for Isilon OneFS page of the EMC Online Support site at https://support.emc.com/downloads/15209_Isilon-OneFS. 

Credit: 
Dell EMC would like to thank Honggang Ren of Fortinet's FortiGuard Labs for reporting this vulnerability.

Registered EMC Online Support customers can download IsilonSD Edge installation files from the 'Downloads for IsilonSD Edge' page on the EMC Online Support site at https://support.emc.com/downloads/39972_IsilonSD-Edge. 


Read and use the information in this Dell EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact Dell EMC Software Technical Support at 1-877-534-2867.

For an explanation of Severity Ratings, refer to Dell EMC Knowledgebase article 468307. Dell EMC recommends all customers take into account both the base score and any relevant temporal and environmental scores which may impact the potential severity associated with particular security vulnerability.

Read and use the information in this Dell EMC Security Advisory to assist in avoiding any situation that might arise from the problems described herein. If you have any questions regarding this product alert, contact Dell EMC Software Technical Support at 1-877-534-2867. Dell EMC distributes Dell EMC Security Advisories, in order to bring to the attention of users of the affected Dell EMC products, important security information. Dell EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. Dell EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event, shall Dell EMC or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or spe
 cial damages, even if Dell EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJbm7liAAoJEIEpaHw9mIunhQ8QAKfCC0a2T+uAIW+Kdmq88nU/
ojoikOtapSlKBVS8DADwZ3lv6TLXCrLyBcq2iIksGtFKqGuT0n/NeAYLWeUgJANM
Jk3OAj84ANz7dkyYn3WoH+N6RDOZSTsU8Zxz8C15kniUgktglhCNn1ck8+poCUw6
pxsHlPsG483haYOysUAEPEdZpj9P8y6QhwN6gjTV5Ro3iv6iZhQjK9lYzPIhK/i9
khV3eoo6uVKheF6fNS1vTZ7i1meUIkI+OaLBwK1CC7GAb6PX0DE28aA7gANeG7xm
OKdMb8UDzItEZbjxH2dc6cPJ/czYgZa179RXuOTJnSA2wP/M+thMtDxbRU/5tP5O
b7DFvbIF9NUg7dSJZ+xSB3qciobtVM+3cO6h0E65XDqru7/DQ0Id0aLivvyx1M3x
OPdI49HZozYbxDlhIUN/YnY24WozvUFPNsUA6GG6JPh7w6rAPuoTujnAAEl7Ob5G
wrDGFTYA9dGYvkVs6N1mSyO+Tsp7TL3CIsu1ZGZXMNrA6Y05BOoq/H4bVppdBw3B
Dl6bwfEJZBy4YvDGeYJK0Ogyhd+P4vYplSxNB6YPRxSCLJdsheUezbzO2LE+tHYC
wNn2QIM7/XUBfwrQGl66wa4D2hNIkmrvcSOkyTK5UyDg/RxpSyTgoJIB8hwVQw3n
pHbWGoCMm4mA6QyjrOlQ
=bp6T
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists