[FD] DSA-2018-147: Dell EMC Isilon OneFS and IsilonSD Edge Remote Process Crash Vulnerability

[<secure@xxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

DSA-2018-147: Dell EMC Isilon OneFS and IsilonSD Edge Remote Process Crash 
Vulnerability   

Dell EMC Identifier: DSA-2018-147

CVE Identifier: CVE-2018-11071

Severity: High

Severity Rating: CVSS v3 Base Score: 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products:
Dell EMC Isilon OneFS 7.1.1.x
Dell EMC Isilon OneFS 7.2.1.x
Dell EMC Isilon OneFS 8.0.0.x
Dell EMC Isilon OneFS 8.0.1.x
Dell EMC Isilon OneFS 8.1.0.x
Dell EMC Isilon OneFS 8.1.x prior to 8.1.2 
Dell EMC IsilonSD Edge 8.0.0.x
Dell EMC IsilonSD Edge 8.0.1.x
Dell EMC IsilonSD Edge 8.1.0.x 
Dell EMC IsilonSD Edge 8.1.x prior to 8.1.2

Summary:  
Dell EMC Isilon OneFS and Dell EMC IsilonSD Edge require a security update to 
address a remote process crash vulnerability.   

Details:  
Dell EMC Isilon OneFS versions 7.1.1.x, 7.2.1.x, 8.0.0.x, 8.0.1.x, 8.1.0.x and 
8.1.x prior to 8.1.2 and Dell EMC IsilonSD Edge versions 8.0.0.x, 8.0.1.x, 
8.1.0.x and 8.1.x prior to 8.1.2 contain a remote process crash vulnerability.  
An unauthenticated remote attacker may potentially exploit this vulnerability 
to crash the isi_drive_d process by sending specially crafted input data to the 
affected system. This process will then be restarted.

Resolution:  
The following release contains a resolution to this vulnerability:
*       Dell EMC Isilon OneFS versions 8.1.2 and later
*       Dell EMC IsilonSD Edge versions 8.1.2 and later


Dell EMC recommends all customers upgrade at the earliest opportunity. Contact 
Dell EMC Isilon OneFS   customer support to download the required rpm file and 
install it. 

Link to remedies:
Registered EMC Online Support customers can download OneFS installation files 
from the Downloads for Isilon OneFS page of the EMC Online Support site at 
https://support.emc.com/downloads/15209_Isilon-OneFS. 

Credit: 
Dell EMC would like to thank Honggang Ren of Fortinet's FortiGuard Labs for 
reporting this vulnerability.

Registered EMC Online Support customers can download IsilonSD Edge installation 
files from the 'Downloads for IsilonSD Edge' page on the EMC Online Support 
site at https://support.emc.com/downloads/39972_IsilonSD-Edge. 


Read and use the information in this Dell EMC Security Advisory to assist in 
avoiding any situation that might arise from the problems described herein. If 
you have any questions regarding this product alert, contact Dell EMC Software 
Technical Support at 1-877-534-2867.

For an explanation of Severity Ratings, refer to Dell EMC Knowledgebase article 
468307. Dell EMC recommends all customers take into account both the base score 
and any relevant temporal and environmental scores which may impact the 
potential severity associated with particular security vulnerability.

Read and use the information in this Dell EMC Security Advisory to assist in 
avoiding any situation that might arise from the problems described herein. If 
you have any questions regarding this product alert, contact Dell EMC Software 
Technical Support at 1-877-534-2867. Dell EMC distributes Dell EMC Security 
Advisories, in order to bring to the attention of users of the affected Dell 
EMC products, important security information. Dell EMC recommends that all 
users determine the applicability of this information to their individual 
situations and take appropriate action. The information set forth herein is 
provided "as is" without warranty of any kind. Dell EMC disclaims all 
warranties, either express or implied, including the warranties of 
merchantability, fitness for a particular purpose, title and non-infringement. 
In no event, shall Dell EMC or its suppliers, be liable for any damages 
whatsoever including direct, indirect, incidental, consequential, loss of 
business profit
 s or spe
 cial damages, even if Dell EMC or its suppliers have been advised of the 
possibility of such damages. Some states do not allow the exclusion or 
limitation of liability for consequential or incidental damages, so the 
foregoing limitation may not apply.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJbm7liAAoJEIEpaHw9mIunhQ8QAKfCC0a2T+uAIW+Kdmq88nU/
ojoikOtapSlKBVS8DADwZ3lv6TLXCrLyBcq2iIksGtFKqGuT0n/NeAYLWeUgJANM
Jk3OAj84ANz7dkyYn3WoH+N6RDOZSTsU8Zxz8C15kniUgktglhCNn1ck8+poCUw6
pxsHlPsG483haYOysUAEPEdZpj9P8y6QhwN6gjTV5Ro3iv6iZhQjK9lYzPIhK/i9
khV3eoo6uVKheF6fNS1vTZ7i1meUIkI+OaLBwK1CC7GAb6PX0DE28aA7gANeG7xm
OKdMb8UDzItEZbjxH2dc6cPJ/czYgZa179RXuOTJnSA2wP/M+thMtDxbRU/5tP5O
b7DFvbIF9NUg7dSJZ+xSB3qciobtVM+3cO6h0E65XDqru7/DQ0Id0aLivvyx1M3x
OPdI49HZozYbxDlhIUN/YnY24WozvUFPNsUA6GG6JPh7w6rAPuoTujnAAEl7Ob5G
wrDGFTYA9dGYvkVs6N1mSyO+Tsp7TL3CIsu1ZGZXMNrA6Y05BOoq/H4bVppdBw3B
Dl6bwfEJZBy4YvDGeYJK0Ogyhd+P4vYplSxNB6YPRxSCLJdsheUezbzO2LE+tHYC
wNn2QIM7/XUBfwrQGl66wa4D2hNIkmrvcSOkyTK5UyDg/RxpSyTgoJIB8hwVQw3n
pHbWGoCMm4mA6QyjrOlQ
=bp6T
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/