search menu icon-carat-right cmu-wordmark
Carnegie Mellon University

Software Engineering Institute

CERT Coordination Center

Dell PowerConnect 6248P series switch denial of service vulnerability

Vulnerability Note VU#160460

Original Release Date: 2013-02-22 | Last Revised: 2013-02-22

Overview

Dell PowerConnect 6248P series switches contain a denial of service vulnerability when parsing malformed requests.

Description

Dell PowerConnect 6248P series switches contain a denial of service vulnerability when parsing malformed requests which could cause the switch to crash and become unavailable.

Impact

An authenticated attacker can cause the Dell PowerConnect 6248P series switch to crash and become unavailable.

Solution

We are currently unaware of a practical solution to this problem.

Restrict Access

The Dell PowerConnect M6220 series switch web interface should not be Internet facing.

Vendor Information

160460
 
Expand all

Dell Computer Corporation, Inc. Affected

Notified:  January 09, 2013 Updated: February 18, 2013

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

We are not aware of further vendor information regarding this vulnerability.


CVSS Metrics

Group Score Vector
Base 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C
Temporal 6 E:POC/RL:W/RC:UC
Environmental 1.6 CDP:L/TD:L/CR:ND/IR:ND/AR:ND

References

http://www.dell.com/us/enterprise/p/powerconnect-6248P/pd

Acknowledgements

Thanks to Gary Blosser for reporting this vulnerability.

This document was written by Michael Orlando.

Other Information

CVE IDs: CVE-2013-0120
Date Public: 2013-02-22
Date First Published: 2013-02-22
Date Last Updated: 2013-02-22 17:33 UTC
Document Revision: 8

Sponsored by CISA.

Download PGP Key

Read CERT/CC Blog

Learn about Vulnerability Analysis