SB2022102811 - Multiple vulnerabilities in Dell EMC Isilon OneFS and Dell EMC PowerScale OneFS

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022102811

SB2022102811 - Multiple vulnerabilities in Dell EMC Isilon OneFS and Dell EMC PowerScale OneFS

Published: October 28, 2022

Security Bulletin ID SB2022102811
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2019-5611)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a missing check in the code of m_pulldown(9) when processing IPv6 packets. A remote attacker can send specially crafted IPv6 traffic to the affected system and perform denial of service (DoS) attack.


2) Memory leak (CVE-ID: CVE-2020-7451)

The vulnerability allows a remote attacker to gain access to sensitive kernel information.

The vulnerability exists due memory leak in IPv6 implementation in FreeBSD, when processing network traffic over TCP, which leads to disclosure of one byte of kernel memory with every TCP SYN-ACK (or challenge TCP-ACK) segment sent over IPv6. A remote attacker can initiate a TCP connection over IPv6 protocol with an affected system and gain access to sensitive information, stored in kernel.


Remediation

Install update from vendor's website.

References