'[FD] DSA-2018-136: Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability'

[prev in list] [next in list] [prev in thread] [next in thread] 

List:       full-disclosure
Subject:    [FD] DSA-2018-136: Dell EMC Integrated Data Protection Appliance Undocumented Accounts Vulnerability
From:       <secure () Dell ! com>
Date:       2018-10-29 21:35:27
Message-ID: 3fdd2a4ac1c54710af3e9bd6b0f32bdc () AUSX13MPS302 ! AMER ! DELL ! COM
[Download RAW message or body]

Affected products:

Dell EMC Integrated Data Protection Appliance 2.0

Dell EMC Integrated Data Protection Appliance 2.1

Dell EMC Integrated Data Protection Appliance 2.2

Summary:

Integrated Data Protection Appliance (iDPA) contains undocumented accounts with limited access \
which may potentially be used by a malicious user to compromise the affected system.

Details:

Integrated Data Protection Appliance versions 2.0, 2.1, and 2.2 contain undocumented accounts \
named "support" and "admin" that are protected with default passwords. These accounts have \
limited privileges and can access certain system files only. A malicious user with the \
knowledge of the default passwords may potentially log in to the system and gain read and write \
access to certain system files.

Resolution:

Follow the steps below to remove the user accounts named "support" and "admin" from the \
impacted virtual machines in the Integrated Data Protection Appliance. There is no loss of \
supportability or any other product functionality as a result of the removal of these accounts.

Log in to Data Protection Advisor - Datastore Server Virtual Machine using an SSH client such \
as PuTTY, as root user and execute the following commands:

Delete the user "support"

userdel support

Delete the user "admin"

userdel admin

Verify that the accounts are deleted. The following commands should display "no such user" as \
the output.

id support

id admin

For Integrated Data Protection Appliance 2.0 and 2.1, repeat the above procedure for Data \
Protection Advisor - Application server, Data Protection Advisor - Agent, Data Protection \
Advisor - DD Data Processor Tool and Appliance Configuration Manager Virtual Machines.

For Integrated Data Protection Appliance 2.2, repeat the above procedure for Data Protection \
Advisor - Application Server and Appliance Configuration Manager Virtual Machines.

Dell EMC strongly recommends that customers follow the security best practices documented in \
the iDPA Security Configuration Guide to secure their deployment at \
https://support.emc.com/products/41849_Integrated-Data-Protection-Appliance/Documentation/

Link To Remedies:

Registered Dell EMC Online Support customers can also download a patch at:

Dell EMC Integrated Data Protection Appliance (IDPA) 2.1 - \
https://download.emc.com/downloads/DL89669_Idpa_post_update_2.1.0.599285.tar.gz

If you have any questions, contact Dell EMC Support.

Severity Rating

For an explanation of Severity Ratings, refer to Dell EMC Knowledgebase article 468307 \
(https://support.emc.com/kb/468307). Dell EMC recommends all customers take into account both \
the base score and any relevant temporal and environmental scores which may impact the \
potential severity associated with particular security vulnerability.

Legal Information

Read and use the information in this Dell EMC Security Advisory to assist in avoiding any \
situation that might arise from the problems described herein. If you have any questions \
regarding this advisory, contact Dell EMC Technical Support \
(https://support.emc.com/servicecenter/contactEMC/). Dell EMC distributes Dell EMC Security \
Advisories, in order to bring to the attention of users of the affected Dell EMC products, \
important security information. Dell EMC recommends that all users determine the applicability \
of this information to their individual situations and take appropriate action. The information \
set forth herein is provided "as is" without warranty of any kind. Dell EMC disclaims all \
warranties, either express or implied, including the warranties of merchantability, fitness for \
a particular purpose, title and non-infringement. In no event, shall Dell EMC or its suppliers, \
be liable for any damages whatsoever including direct, indirect, incidental, consequential, \
loss of bus  iness profits or special damages, even if Dell EMC or its suppliers have been \
advised of the possibility of such damages. Some states do not allow the exclusion or \
limitation of liability for consequential or incidental damages, so the foregoing limitation \
may not apply.

Dell Product Security Incident Response Team

secure@dell.com

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEP5nobPoCj3pTvhAZgSlofD2Yi6cFAlvXfMkACgkQgSlofD2Y

i6cQXA//Wrj8FEvq+erHQhNyZPNWGEnQKTTYim0ErQu9IQhMRLNK0K0t4ZRX86oT

xWydHZQenOYZljGrg2lLB+XxU27s7SOGxMeaMrdfMUkRsXkNTBUw7+JqAlFI5BXS

Ni9IznNdrThGKh+wenlkFYTzRTOLzE33YAWRNUluQHIF0841cYIf6BjKu96lpsCq

6OisPcJzoFDf3SSpMvFWFZE9RawKhA2KadX1kLI0k8QvI1F2N6VFrdzxcKSspEtW

P69JaO0tBf4f5mToFRbDyKWhbtRZCcvzNuZZFMFUI2Xq66CO54LXfZGPLhBypK6S

oCWBxHFTyU0me376rwK5CMwO/F+UGgCkhFDZCYxRUyHIQa3dbBo+xGnRtCrxYcEB

vpGtNv2suSj2VFfWIVAItq1Ihzr9xbh+A96lHtr/Dj9N2OChr3VUXiSMSMMdE9N+

fUjGCtWvJeRUeH3e20yYNKAHYsHJtEwc9issBoq2hUmE7JMDaNvtQrKtUky2U+/I

vRWhfBOPz2KdkBJbT7CgQV0hRew6adCcy30/6G8HS7Howk3U/9vQA6RVw7fzdTZs

Ukg/tTaWRKuBAI7ry6hN2CmzIvOJGByVEuyGiTPGcw1C2UoqAnmpRjMi1JTaZDEd

A47EyNcyhIf0jrXDbqPbF9TRBlDIjBVIti9ldLyCcuoVOhlt8Ig=

=ATU/

-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

[prev in list] [next in list] [prev in thread] [next in thread] 