CVE-2018-11053: iSM: Dell EMC iDRAC Service Module Improper File Permission Vulnerability
Dell EMC iDRAC Service Module for all supported Linux and XenServer versions v3.0.1, v3.0.2, v3.1.0, v3.2.0, when started, changes the default file permission of the hosts file of the host operating system (/etc/hosts) to world writable. A malicious low privileged operating system user or process could modify the host file and potentially redirect traffic from the intended destination to sites hosting malicious or unwanted content.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2018-11053?
CVE-2018-11053 is a vulnerability in the Dell EMC iDRAC Service Module for Linux and XenServer that allows a low privileged user to change the default file permissions of the hosts file to world writable.
Which versions of Dell EMC iDRAC Service Module are affected?
The affected versions of Dell EMC iDRAC Service Module are v3.0.1, v3.0.2, v3.1.0, and v3.2.0.
What is the severity of CVE-2018-11053?
The severity of CVE-2018-11053 is medium (6.5).
How can a malicious user exploit this vulnerability?
A malicious low privileged user or process can exploit this vulnerability to modify the hosts file and potentially gain unauthorized access to the host operating system.
Are Citrix XenServer and Redhat Enterprise Linux affected by CVE-2018-11053?
No, Citrix XenServer and Redhat Enterprise Linux are not affected by CVE-2018-11053.