{"id":8433,"date":"2021-07-08T12:53:22","date_gmt":"2021-07-08T19:53:22","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?post_type=patch_watch&p=8433"},"modified":"2023-03-07T16:09:19","modified_gmt":"2023-03-07T23:09:19","slug":"dell-users-patch-these-four-security-vulnerabilities","status":"publish","type":"patch_watch","link":"https:\/\/10.42.32.162\/patch_watch\/dell-users-patch-these-four-security-vulnerabilities\/","title":{"rendered":"Dell Users: Patch these Four Security Vulnerabilities"},"content":{"rendered":"

On June 24, 2021, Dell released fixes for four BIOS connect vulnerabilities that expose over 30 million individual devices. These security flaws could allow unauthorized remote code execution in a pre-boot environment for 129 different Dell products by giving a high-level control of the operating systems (OS).<\/p>\n

\"\"<\/p>\n

Reasons to Patch these Vulnerabilities<\/h2>\n

We examined the recently patched Dell vulnerabilities and here are our findings –<\/p>\n

    \n
  1. \n

    Three of the Dell vulnerabilities are Remote Code Execution possibilities and one is Denial of Service.<\/p>\n<\/li>\n

  2. \n

    Successful exploitation of these Dell BIOSConnect and HTTPS Boot features could potentially lead to a supply chain attack leading to complete control of the system by attackers.<\/p>\n<\/li>\n

  3. \n

    Three CVEs are rated high and one of medium severity.<\/p>\n<\/li>\n

  4. \n

    The CVSS V3 score assigned to these vulnerabilities ranges from 5.9 (medium) to 7.2 (high).<\/p>\n<\/li>\n

  5. \n

    This series of vulnerabilities lead to Improper Certificate Validation and Buffer Overflow classified under CWE-295, CWE-122, and CWE-121.<\/p>\n<\/li>\n

  6. \n

    A patch is available for these vulnerabilities, which reduces the risk posed by threat actors.<\/p>\n<\/li>\n

  7. \n

    Yet, there are no publicly known exploits for these CVEs.<\/p>\n<\/li>\n

  8. \n

    All the popular scanners failed to detect these four vulnerabilities.<\/p>\n<\/li>\n<\/ol>\n

    Severity Scores<\/h2>\n

    \"\"<\/strong><\/p>\n

    Timeline<\/h2>\n\n\n\n\n\n\n\n\n
    Date<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
    March 2, 2021<\/td>\nEclypsium discovered four vulnerabilities in Dell.<\/td>\n<\/tr>\n
    March 3, 2021<\/td>\nDell acknowledged the vulnerabilities.<\/td>\n<\/tr>\n
    June 18, 2021<\/td>\nDell remediated two of the issues and published the advisory.<\/td>\n<\/tr>\n
    June 24, 2021<\/td>\nDell issued an enhanced update to all four issues.<\/td>\n<\/tr>\n
    June 24, 2021<\/td>\nVulnerabilities updated in NVD Database.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    It\u2019s worth noting that these vulnerabilities were discovered on March 2, 2021, and it took 118 days to develop a patch for these issues. Therefore, Organizations should continuously work to fix the issues in their product and quickly provide users with either a significant update to the version or a patch.<\/p>\n

    \"\"<\/p>\n