CVE-2018-1243 : Security Advisory and Response

Dell EMC iDRAC6, iDRAC7, and iDRAC8 are affected by a weak CGI session ID vulnerability, potentially allowing remote attackers to conduct bruteforce session guessing attacks.

Understanding CVE-2018-1243

This CVE involves a vulnerability in certain versions of Dell EMC iDRAC6, iDRAC7/iDRAC8, and iDRAC9, related to weak CGI session IDs.

What is CVE-2018-1243?

The vulnerability arises from the utilization of 96-bit numeric-only session ID values in CGI binaries, increasing the risk of remote attackers being able to perform bruteforce session guessing attacks.

The Impact of CVE-2018-1243

CVSS Base Score: 7.5 (High)
Attack Vector: Network
Attack Complexity: High
Privileges Required: Low
Confidentiality, Integrity, and Availability Impact: High

Technical Details of CVE-2018-1243

Vulnerability Description

The weak CGI session ID vulnerability in Dell EMC iDRAC6, iDRAC7/iDRAC8, and iDRAC9 versions prior to specified versions.

Affected Systems and Versions

iDRAC6 versions less than 2.91
iDRAC7 versions less than 2.60.60.60
iDRAC8 versions less than 2.60.60.60

Exploitation Mechanism

The vulnerability allows remote attackers to potentially conduct bruteforce session guessing attacks due to weak session ID values.

Mitigation and Prevention

Immediate Steps to Take

Update affected iDRAC versions to the specified secure versions.
Monitor network traffic for any suspicious activity.

Long-Term Security Practices

Regularly update and patch iDRAC firmware to mitigate known vulnerabilities.
Implement strong access controls and authentication mechanisms.

Patching and Updates

Apply the latest security patches and updates provided by Dell EMC to address the weak CGI session ID vulnerability.