Vulnerability Description
The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. NOTE: the vendor disputes the significance of this issue, stating "DRAC's are intended to be on a separate management network; they are not designed nor intended to be placed on or connected to the Internet."
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Dell | Idrac6 Bmc | All versions |
Related Weaknesses (CWE)
References
- ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-mo
- http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-ch
- http://fish2.com/ipmi/cipherzero.html
- http://osvdb.org/show/osvdb/93039
- http://www.metasploit.com/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero
- http://www.wired.com/threatlevel/2013/07/ipmi/
- https://lists.gnu.org/archive/html/freeipmi-devel/2013-02/msg00013.html
- ftp://ftp.dell.com/Manuals/Common/integrated-dell-remote-access-cntrllr-6-for-mo
- http://en.community.dell.com/techcenter/systems-management/w/wiki/4929.how-to-ch
- http://fish2.com/ipmi/cipherzero.html
- http://osvdb.org/show/osvdb/93039
- http://www.metasploit.com/modules/auxiliary/scanner/ipmi/ipmi_cipher_zero
- http://www.wired.com/threatlevel/2013/07/ipmi/
- https://lists.gnu.org/archive/html/freeipmi-devel/2013-02/msg00013.html
FAQ
What is CVE-2013-4783?
CVE-2013-4783 is a vulnerability with a CVSS score of 10.0 (HIGH). The Dell iDRAC6 with firmware 1.x before 1.92 and 2.x and 3.x before 3.42, and iDRAC7 with firmware before 1.23.23, allows remote attackers to bypass authentication and execute arbitrary IPMI commands...
How severe is CVE-2013-4783?
CVE-2013-4783 has been rated HIGH with a CVSS base score of 10.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-4783?
Check the references section above for vendor advisories and patch information. Affected products include: Dell Idrac6 Bmc.