Vulnerabilities > CVE-2020-5319 - Improper Validation of Array Index vulnerability in Dell products

CVSS 7.8 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

COMPLETE

network

low complexity

dell

CWE-129

NVD

Published: 2020-02-06

Updated: 2020-02-12

Summary

Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementation that is used to provide SFTP service on a NAS server. A remote unauthenticated attacker may potentially exploit this vulnerability and cause a Denial of Service (Storage Processor Panic) by sending an out of order SSH protocol sequence.

Vulnerable Configurations

Part	Description	Count
Application	Dell Dell EMC Unity Operating Environment 4.0.0.7329527 Dell EMC Unity Operating Environment 4.0.1.8194551 Dell EMC Unity Operating Environment 4.0.1.8320161 Dell EMC Unity Operating Environment 4.0.1.8404134 Dell EMC Unity Operating Environment 4.0.2.8627717 Dell EMC Unity Operating Environment 4.1.0.8940590 Dell EMC Unity Operating Environment 4.1.0.8959731 Dell EMC Unity Operating Environment 4.1.0.9058043 Dell EMC Unity Operating Environment 4.1.1.9138882 Dell EMC Unity Operating Environment 4.1.2.9257522 Dell EMC Unity Operating Environment 4.2.0.9392909 Dell EMC Unity Operating Environment 4.2.0.9476662 Dell EMC Unity Operating Environment 4.2.1.9535982 Dell EMC Unity Operating Environment 4.2.2.9632250 Dell EMC Unity Operating Environment 4.2.3.9670635 Dell EMC Unity Operating Environment 4.3.1.1525703027 Dell EMC Unity Operating Environment 4.4.0.1534750794 Dell EMC Unity Operating Environment 4.4.1.1539309879 Dell EMC Unity XT Operating Environment * Dell EMC Unityvsa Operating Environment 4.0.0.7329527 Dell EMC Unityvsa Operating Environment 4.0.1.8194551 Dell EMC Unityvsa Operating Environment 4.0.1.8320161 Dell EMC Unityvsa Operating Environment 4.0.1.8404134 Dell EMC Unityvsa Operating Environment 4.0.2.8627717 Dell EMC Unityvsa Operating Environment 4.1.0.8940590 Dell EMC Unityvsa Operating Environment 4.1.0.8959731 Dell EMC Unityvsa Operating Environment 4.1.0.9058043 Dell EMC Unityvsa Operating Environment 4.1.1.9138882 Dell EMC Unityvsa Operating Environment 4.1.2.9257522 Dell EMC Unityvsa Operating Environment 4.2.0.9392909 Dell EMC Unityvsa Operating Environment 4.2.0.9476662 Dell EMC Unityvsa Operating Environment 4.2.1.9535982 Dell EMC Unityvsa Operating Environment 4.2.2.9632250 Dell EMC Unityvsa Operating Environment 4.2.3.9670635 Dell EMC Unityvsa Operating Environment 4.3.0.1522077968 Dell EMC Unityvsa Operating Environment 4.3.1.1525703027 Dell EMC Unityvsa Operating Environment 4.4.0.1534750794 Dell EMC Unityvsa Operating Environment 4.4.1.1539309879	38

Common Weakness Enumeration (CWE)

CWE-129 - Improper Validation of Array Index

Common Attack Pattern Enumeration and Classification (CAPEC)

Overflow Buffers
Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.

References

https://www.dell.com/support/security/en-us/details/540336/DSA-2020-019-Dell-EMC-Unity-Family-Dell-EMC-Unity-XT-Family-Denial-of-Service-Vulnerability