White Papers

8 Improved Server Security with iDRAC9 and SELinux
enabled, the web server processes in iDRAC9 do not run under root user and are configured to
have limited access to system files.
• CVE-2018-1211: Dell EMC iDRAC7/8
Versions earlier than iDRAC 2.52.52.52 contain a path traversal vulnerability in the web server’s
URI parser that could be used to obtain specific sensitive data without authentication. A
unauthenticated remote attacker might have been able to read configurations settings from the
iDRAC by querying specific URI strings.
• CVE-2018-1211
Due to a programming error in the code, this path traversal vulnerability in IDRAC7/8 could allow
an attacker to remotely access arbitrary files in the IDRAC OS. If a similar vulnerability is found in
iDRAC9, the impact would be greatly reduced because SELinux is configured to significantly limit
the number of files that web server can access. The web server process no longer runs as root.
Both SELinux and UNIX permissions restrict access to many files. Sensitive files, such as
passwords and config database files, cannot be accessed using this vulnerability.
• CVE-2018-1000116: Dell EMC iDRAC7/8
iDRAC 7/8 versions earlier than 2.52.52.52 and iDRAC9 versions earlier than 3.20.20.20 contain
a heap corruption vulnerability in the NET-SNMP service (an open source component) which
could be used to corrupt the heap memory. A remote unauthenticated attacker may be able to
send malformed PDUs to the NET-SNMP service and trigger a heap corruption.
• iDRAC9: This is partially mitigated as SNMP process is one of the few processes still running as
root. However, the SELinux security policy for SNMP restricts access to many important system
files. Dell EMC has released an updated iDRAC version that mitigates this vulnerability by
updating SNMP code. If a similar vulnerability is found in future iDRAC releases, this vulnerability
would be mitigated using a combination of SELinux policy and ‘non-root least privilege’.
3.3 Security issues not mitigated by SELinux and non-root privilege
There are issues that SELinux and ‘non-root least privilege’ cannot mitigate, and it is important that users
understand these limitations.
The issues below are examples of past vulnerabilities discovered in IDRAC that SELinux and ‘non-root least
privileges’ do not mitigate effectively. These examples are provided for illustrative purposes only so that users
can see the limitations of SELinux protection.
• CVE-2018-1249
iDRAC9 versions earlier than 3.21.21.21 did not enforce the use of TLS/SSL for a connection to
iDRAC web server for certain URLs. An attacker could use this vulnerability to strip the SSL/TLS
protection from a connection between a client and a server. SELinux cannot mitigate this
vulnerability because it does not involve access to system files.
• CVE-2018-1243
iDRAC6 versions earlier than 2.91, iDRAC7/8 versions earlier than 2.60.60.60, and iDRAC9
versions earlier than 3.21.21.21 contain a weak CGI session ID vulnerability. The sessions
invoked through CGI binaries use 96-bit numeric-only session ID values, which makes it easier
for remote attackers to perform brute-force session guessing attacks. SELinux cannot mitigate
this vulnerability issue because it does not involve access to system files.
In closing, this whitepaper has informed users on the new security enhancements that Dell EMC added to
iDRAC9. We have outlined SELinux and ‘non-root least privilege’ initiative and have shown how these
technologies can help protect customers’ systems from attacks. We have also given examples of historical
security vulnerabilities in earlier version of iDRAC that would be mitigated if they were to occur in iDRAC9.
And finally, we have shown some examples of limitations of these technologies.