[FD] DSA-2018-018: Dell EMC Isilon OneFS Multiple Vulnerabilities

[EMC Product Security Response Center <Security_Alert@xxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

DSA-2018-018: Dell EMC Isilon OneFS Multiple Vulnerabilities

Dell EMC Identifier: DSA-2018-018
CVE Identifier: CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, 
CVE-2018-1201, CVE-2018-1202, CVE-2018-1203, CVE-2018-1204, CVE-2018-1213
Severity: High
Severity Rating: CVSS Base Score: See below for CVSS v3 scores

        
Affected products: 
Dell EMC Isilon OneFS version 8.1.0.2 (CVE-2018-1213 only)
Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs)
Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs)
Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs)
Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, 
CVE-2018-1189, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213)
Dell EMC Isilon OneFS version 7.1.1.11 (CVE-2018-1186, CVE-2018-1189, 
CVE-2018-1201, CVE-2018-1202, CVE-2018-1204, CVE-2018-1213)


Summary:  
Dell EMC Isilon OneFS is affected by multiple security vulnerabilities that may 
potentially be exploited by a malicious administrator and lead to root 
functions within Isilon OneFS, running in compadmin mode, being compromised.

Note: In Isilon OneFS, running in compadmin mode, compadmin user is less 
privileged than the nodes' root users.

Details 
Incorrect Authorization Vulnerability (CVE-2018-1203)

In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root 
privileges. The tcpdump binary, being run with sudo, may potentially be used by 
compadmin to execute arbitrary code with root privileges.
CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Path Traversal Vulnerability (CVE-2018-1204)

Dell EMC Isilon OneFS is affected by a path traversal vulnerability in the 
isi_phone_home tool. A malicious compadmin may potentially exploit this 
vulnerability to execute arbitrary code with root privileges.
CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Cross-Site Scripting Vulnerability in Cluster Description (CVE-2018-1186)

Dell EMC Isilon is affected by a cross-site scripting vulnerability in the 
Cluster description of the OneFS web administration interface. A malicious 
administrator may potentially inject arbitrary HTML or JavaScript code in the 
user's browser session in the context of the OneFS website. 
CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)?

Cross-Site Scripting Vulnerability in Network Configuration Page (CVE-2018-1187)

Dell EMC Isilon is affected by a cross-site scripting vulnerability in the 
Network Configuration page within the OneFS web administration interface. A 
malicious administrator may potentially inject arbitrary HTML or JavaScript 
code in the user's browser session in the context of the OneFS website. 
CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)

Cross-Site Scripting Vulnerability in Authorization Providers Page 
(CVE-2018-1188)

Dell EMC Isilon is affected by a cross-site scripting vulnerability in the 
Authorization Providers page within the OneFS web administration interface. A 
malicious administrator may potentially inject arbitrary HTML or JavaScript 
code in the user's browser session in the context of the OneFS website. 
CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)

Cross-Site Scripting Vulnerability in Antivirus Page (CVE-2018-1189)

Dell EMC Isilon is affected by a cross-site scripting vulnerability in the 
Antivirus Page within the OneFS web administration interface. A malicious 
administrator may potentially inject arbitrary HTML or JavaScript code in the 
user's browser session in the context of the OneFS website. 
CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)

Cross-Site Scripting Vulnerability in Job Operations Page (CVE-2018-1201)

Dell EMC Isilon is affected by a cross-site scripting vulnerability in the Job 
Operations Page within the OneFS web administration interface. A malicious 
administrator may potentially inject arbitrary HTML or JavaScript code in the 
user's browser session in the context of the OneFS website. 
CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)

Cross-Site Scripting Vulnerability in NDMP Page (CVE-2018-1202)

Dell EMC Isilon is affected by a cross-site scripting vulnerability in the NDMP 
Page within the OneFS web administration interface. A malicious administrator 
may potentially inject arbitrary HTML or JavaScript code in the user's browser 
session in the context of the OneFS website. 
CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)

Cross-Site Request Forgery Vulnerability (CVE-2018-1213) 

Dell EMC Isilon OneFS is affected by a cross-site request forgery 
vulnerability. A malicious user may potentially exploit these vulnerability to 
send unauthorized requests to the server on behalf of authenticated users of 
the application.
CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Resolution:     
The following Dell EMC Isilon OneFS maintenance releases addresses these 
vulnerabilities (except for CVE-2018-1213): 

Dell EMC Isilon OneFS 8.1.0.2

Patches are available for the below versions: 

Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only)

Patch-217638 for OneFS 8.1.0.1 (all CVEs)

Patch-213281 for OneFS 8.1.0.0 (all CVEs)

Patch-213280 for OneFS 8.0.1.2 (all CVEs)

Patch-213278 for OneFS 8.0.0.6 (all CVEs)

Patch-217637 for OneFS 8.0.0.5 (all CVEs)

Patch-211980 for OneFS 8.0.0.4 (all CVEs)

IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are 
using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the 
patch.

Dell EMC recommends that all customers upgrade to a version or patch which 
addresses these vulnerabilities at the earliest opportunity.

This advisory will be updated when fixes are available for additional versions.

Link To Remedies:       
Registered Dell EMC Online Support customers can download OneFS installation 
files from the Downloads for Isilon OneFS page of the Dell EMC Online Support 
site at https://support.emc.com/downloads/15209_Isilon-OneFS.

If you have any questions, contact Dell EMC Support.

Credit:
Dell EMC would like to thank Ivan Huertas and Maximiliano Vidal from Core 
Security Consulting Services for reporting these vulnerabilities.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ
319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiT
RR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaW
u5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt
05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZN
Eh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko=
=c/8F
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/