Details of VAR-201704-0165

ID

VAR-201704-0165

CVE

CVE-2015-7272

TITLE

plural Dell iDRAC Service disruption in products (DoS) Vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2015-007496

DESCRIPTION

Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a long SSH username or input. Dell integrated Remote Access Controller is prone to a remote buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user supplied data. Successfully exploiting this issue may allow an attacker to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will result in a denial-of-service condition. iDRAC7and iDRAC8 versions prior to 2.21.21.21 are vulnerable. This solution provides functions such as remote management, crash recovery and power control for Dell PowerEdge systems. A buffer overflow vulnerability exists in Dell iDRAC 6 prior to 2.80, 7 and 8 prior to 2.21.21.21. An attacker could exploit this vulnerability to cause a denial of service

Trust: 2.07

sources: NVD: CVE-2015-7272 // JVNDB: JVNDB-2015-007496 // BID: 97532 // VULHUB: VHN-85233 // VULMON: CVE-2015-7272

AFFECTED PRODUCTS

vendor:	dell	model:	integrated remote access controller	scope:	lte	version:	1.99	Trust: 1.0
vendor:	dell	model:	integrated remote access controller	scope:	lte	version:	2.20.20.20	Trust: 1.0
vendor:	dell	model:	idrac6	scope:	lt	version:	2.80	Trust: 0.8
vendor:	dell	model:	idrac7	scope:	lt	version:	2.21.21.21	Trust: 0.8
vendor:	dell	model:	idrac8	scope:	lt	version:	2.21.21.21	Trust: 0.8
vendor:	dell	model:	integrated remote access controller	scope:	eq	version:	2.20.20.20	Trust: 0.6
vendor:	dell	model:	integrated remote access controller	scope:	eq	version:	1.99	Trust: 0.6
vendor:	dell	model:	idrac8	scope:	eq	version:	0	Trust: 0.3
vendor:	dell	model:	idrac7	scope:	eq	version:	0	Trust: 0.3
vendor:	dell	model:	idrac8	scope:	ne	version:	2.21.21.21	Trust: 0.3
vendor:	dell	model:	idrac7	scope:	ne	version:	2.21.21.21	Trust: 0.3

sources: BID: 97532 // JVNDB: JVNDB-2015-007496 // CNNVD: CNNVD-201704-535 // NVD: CVE-2015-7272

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-7272
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2015-7272
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201704-535
value:	HIGH
Trust: 0.6
VULHUB:	VHN-85233
value:	HIGH
Trust: 0.1
VULMON:	CVE-2015-7272
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-7272
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-85233
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2015-7272
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-85233 // VULMON: CVE-2015-7272 // JVNDB: JVNDB-2015-007496 // CNNVD: CNNVD-201704-535 // NVD: CVE-2015-7272

PROBLEMTYPE DATA

problemtype:

CWE-119

Trust: 1.9

sources: VULHUB: VHN-85233 // JVNDB: JVNDB-2015-007496 // NVD: CVE-2015-7272

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201704-535

TYPE

buffer overflow

Trust: 0.6

sources: CNNVD: CNNVD-201704-535

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-007496

PATCH

title:	Dell iDRAC Response to CVE (Common Vulnerabilities and Exposures) ID CVE-2015-7270, 7271, 7272, 7273, 7274, and 7275 - 2 DEC 2015	url:	http://en.community.dell.com/techcenter/extras/m/white_papers/20441859	Trust: 0.8
title:	Dell Integrated Remote Access Controller 6 , 7 and 8 Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=70169	Trust: 0.6
title:	-	url:	https://github.com/chnzzh/iDRAC-CVE-lib	Trust: 0.1

sources: VULMON: CVE-2015-7272 // JVNDB: JVNDB-2015-007496 // CNNVD: CNNVD-201704-535

EXTERNAL IDS

db:	NVD	id:	CVE-2015-7272	Trust: 2.9
db:	BID	id:	97532	Trust: 1.5
db:	JVNDB	id:	JVNDB-2015-007496	Trust: 0.8
db:	CNNVD	id:	CNNVD-201704-535	Trust: 0.7
db:	VULHUB	id:	VHN-85233	Trust: 0.1
db:	VULMON	id:	CVE-2015-7272	Trust: 0.1

sources: VULHUB: VHN-85233 // VULMON: CVE-2015-7272 // BID: 97532 // JVNDB: JVNDB-2015-007496 // CNNVD: CNNVD-201704-535 // NVD: CVE-2015-7272

REFERENCES

url:	http://en.community.dell.com/techcenter/extras/m/white_papers/20441859	Trust: 2.1
url:	http://www.securityfocus.com/bid/97532	Trust: 1.3
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7272	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2015-7272	Trust: 0.8
url:	http://dell.com	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/119.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://github.com/chnzzh/idrac-cve-lib	Trust: 0.1

sources: VULHUB: VHN-85233 // VULMON: CVE-2015-7272 // BID: 97532 // JVNDB: JVNDB-2015-007496 // CNNVD: CNNVD-201704-535 // NVD: CVE-2015-7272

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 97532

SOURCES

db:	VULHUB	id:	VHN-85233
db:	VULMON	id:	CVE-2015-7272
db:	BID	id:	97532
db:	JVNDB	id:	JVNDB-2015-007496
db:	CNNVD	id:	CNNVD-201704-535
db:	NVD	id:	CVE-2015-7272

LAST UPDATE DATE

2025-04-20T23:36:56.411000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-85233	date:	2017-04-14T00:00:00
db:	VULMON	id:	CVE-2015-7272	date:	2017-04-14T00:00:00
db:	BID	id:	97532	date:	2017-04-09T00:00:00
db:	JVNDB	id:	JVNDB-2015-007496	date:	2017-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201704-535	date:	2017-05-18T00:00:00
db:	NVD	id:	CVE-2015-7272	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-85233	date:	2017-04-10T00:00:00
db:	VULMON	id:	CVE-2015-7272	date:	2017-04-10T00:00:00
db:	BID	id:	97532	date:	2017-04-09T00:00:00
db:	JVNDB	id:	JVNDB-2015-007496	date:	2017-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201704-535	date:	2017-04-09T00:00:00
db:	NVD	id:	CVE-2015-7272	date:	2017-04-10T03:59:00.810