Vulnerability Note VU#920038

Dell iDRAC 6 and iDRAC 7 are vulnerable to a cross-site scripting (XSS) attack

Original Release date: 23 Sep 2013 | Last revised: 24 Sep 2013

Overview

Dell iDRAC 6 version 1.41, Dell iDRAC 7 version 1.40.40 and possibly earlier versions contain a reflected cross-site scripting (XSS) (CWE-79) vulnerability.

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Dell iDRAC 6 version 1.41 and Dell iDRAC 7 version 1.40.40's administrative web interface login page can allow remote attackers to inject arbitrary script via the vulnerable query string parameter ErrorMsg.

Impact

A remote unauthenticated attacker may be able to execute arbitrary script in the context of the user's browser.

Solution

We are currently unaware of a practical solution to this problem. Please consider the following workarounds.

Apply an Update

Firmware updates will be posted to the Dell support page when available. Users should download the appropriate update for the version of iDRAC they have installed:

  • iDRAC6 “monolithic” (rack and towers) – FW version 1.96; targeted release date is Q4CY13.
  • iDRAC7 all models – FW version 1.46.45; target release date is mid/late September 2013.
  • NOTE: iDRAC6 “modular” (blades) are not affected; no updates are required.

Restrict access

As a general good security practice, only allow connections from trusted hosts and networks. Note that restricting access does not prevent XSS attacks since the attack comes as an HTTP request from a legitimate user's host. Restricting access would prevent an attacker from accessing the Dell iDRAC web interface using stolen credentials from a blocked network location.

Vendor Information (Learn More)

VendorStatusDate NotifiedDate Updated
Dell Computer Corporation, Inc.Affected01 Jul 201323 Sep 2013
If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group Score Vector
Base 8.5 AV:N/AC:L/Au:N/C:P/I:C/A:N
Temporal 7.7 E:F/RL:W/RC:ND
Environmental 1.9 CDP:ND/TD:L/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Tudor Enache of Help AG Middle East for reporting this vulnerability.

This document was written by Adam Rauf.

Other Information

  • CVE IDs: CVE-2013-3589
  • Date Public: 23 Sep 2013
  • Date First Published: 23 Sep 2013
  • Date Last Updated: 24 Sep 2013
  • Document Revision: 23

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.