¡¾Îó²îͨ¸æ¡¿Dell DSITV Ó²±àÂë¼ÓÃÜÃÜÔ¿Îó²î£¨CVE-2023-39250£©
Ðû²¼Ê±¼ä 2023-08-11Ò»¡¢Îó²î¸ÅÊö
CVE ID | CVE-2023-39250 | ·¢Ã÷ʱ¼ä | 2023-08-11 |
Àà ÐÍ | Ó²±àÂë¼ÓÃÜÃÜÔ¿ | µÈ ¼¶ | ¸ßΣ |
¹¥»÷ÏòÁ¿ | ËùÐèȨÏÞ | ||
¹¥»÷ÖØÆ¯ºó | µÍ | Óû§½»»¥ | ÎÞ |
PoC/EXP | δ¹ûÕæ | ÔÚҰʹÓà | δ֪ |
8ÔÂ11ÈÕ£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøVSRC¼à²âµ½Dell DSITVÖб£´æÒ»¸öÓ²±àÂëÎó²î£¨CVE-2023-39250£©¡£¡£¡£¡£¡£
Dell Storage Integration Tools for VMware (DSITV£¬£¬£¬£¬£¬»òCITV¡¢Compellent DSITV£¬£¬£¬£¬£¬´÷¶ûÊÕ¹ºÁËCompellent¹«Ë¾À©Õ¹ÆóÒµ´æ´¢²úÆ·Ïß) ÊÇÊÊÓÃÓÚVMware µÄ´÷¶û´æ´¢¼¯³É¹¤¾ß¡£¡£¡£¡£¡£
¸ÃÈí¼þÖ§³ÖÓëVMware vCenterµÄ´æ´¢¼¯³É£¬£¬£¬£¬£¬VMware vCenterÊÇÒ»¸öÆÕ±éʹÓõÄÓÃÓÚÖÎÀíESXiÐéÄâ»úµÄƽ̨¡£¡£¡£¡£¡£µ«Òª¼¯³É¿Í»§¶Ë£¬£¬£¬£¬£¬±ØÐèʹÓÃVMware vCenterƾ֤¶ÔÆä¾ÙÐÐÉèÖ㬣¬£¬£¬£¬ÕâЩƾ֤´æ´¢ÔÚDell³ÌÐòµÄ¼ÓÃÜÉèÖÃÎļþÖС£¡£¡£¡£¡£
Dell CompellentÈí¼þĿ¼°üÀ¨Ò»¸ö JAR Îļþ£¬£¬£¬£¬£¬¸ÃÎļþÔÚ·´±àÒëºó»áÏÔʾӲ±àÂëµÄ¾²Ì¬AES¼ÓÃÜÃÜÔ¿£¬£¬£¬£¬£¬¸ÃÃÜÔ¿¹ØÓÚËùÓÐ×°ÖõÄËùÓÐDell ¿Í»§À´Ëµ¶¼ÊÇÏàͬµÄ¡£¡£¡£¡£¡£¸ÃAES¼ÓÃÜÃÜÔ¿ÓÃÓÚ¼ÓÃÜCITVÉèÖÃÎļþ£¬£¬£¬£¬£¬¸ÃÎļþ°üÀ¨³ÌÐòÉèÖ㬣¬£¬£¬£¬°üÀ¨ÊäÈëµÄvCenterÖÎÀíԱƾ֤µÈ¡£¡£¡£¡£¡£
ÓÉÓÚAESÊÇÒ»ÖÖ¶Ô³ÆÃÜÂ룬£¬£¬£¬£¬ËüʹÓÃÏàͬµÄÃÜÔ¿À´¼ÓÃÜÏ¢ÕùÃÜÊý¾Ý£¬£¬£¬£¬£¬ÕâʹµÃÌáÈ¡ÃÜÔ¿µÄÍþвÕß¿ÉÒÔÇáËɽâÃÜÉèÖÃÎļþ²¢¼ìË÷VMware vCenter ÖÎÀíÔ±µÄÓû§ÃûºÍÃÜÂ룬£¬£¬£¬£¬¿ÉÄܵ¼ÖÂÃô¸ÐÐÅϢй¶ºÍδÊÚȨ»á¼û¡£¡£¡£¡£¡£
¶þ¡¢Ó°Ïì¹æÄ£
Dell Storage Integration Tools for VMware (DSITV)Èí¼þ°æ±¾£º06.01.00.016
Èý¡¢Çå¾²²½·¥
3.1 Éý¼¶°æ±¾
ÊÜÓ°ÏìÓû§¿Éƾ֤ÊÊÓÃÓÚVMWareµÄDell´æ´¢¼¯³É¹¤¾ß6.0°æÖÎÀíÔ±Ö¸ÄÏÖеÄ˵Ã÷£¬£¬£¬£¬£¬Í¨¹ýÒÔÏ·½·¨»º½â¸ÃÎó²î£º
¸ü¸ÄʹÓà Compellent DSITV µÄËùÓÐÄ¿½ñ×°±¸µÄĬÈÏrootÃÜÂë¡£¡£¡£¡£¡£
Á´½Ó£º
https://dl.dell.com/content/manual53920915-dell-storage-integration-tools-for-vmware-version-6-1-administrator-s-guide.pdf
3.2 ÔÝʱ²½·¥
ÔÝÎÞ¡£¡£¡£¡£¡£
3.3 ͨÓý¨Òé
l °´ÆÚ¸üÐÂϵͳ²¹¶¡£¬£¬£¬£¬£¬ïÔÌϵͳÎó²î£¬£¬£¬£¬£¬ÌáÉýЧÀÍÆ÷µÄÇå¾²ÐÔ¡£¡£¡£¡£¡£
l ÔöǿϵͳºÍÍøÂçµÄ»á¼û¿ØÖÆ£¬£¬£¬£¬£¬Ð޸ķÀ»ðǽսÂÔ£¬£¬£¬£¬£¬¹Ø±Õ·ÇÐëÒªµÄÓ¦Óö˿ڻòЧÀÍ£¬£¬£¬£¬£¬ïÔ̽«Î£ÏÕЧÀÍ£¨ÈçSSH¡¢RDPµÈ£©Ì»Â¶µ½¹«Íø£¬£¬£¬£¬£¬ïÔ̹¥»÷Ãæ¡£¡£¡£¡£¡£
l ʹÓÃÆóÒµ¼¶Çå¾²²úÆ·£¬£¬£¬£¬£¬ÌáÉýÆóÒµµÄÍøÂçÇå¾²ÐÔÄÜ¡£¡£¡£¡£¡£
l ÔöǿϵͳÓû§ºÍȨÏÞÖÎÀí£¬£¬£¬£¬£¬ÆôÓöàÒòËØÈÏÖ¤»úÖÆºÍ×îСȨÏÞÔÔò£¬£¬£¬£¬£¬Óû§ºÍÈí¼þȨÏÞÓ¦¼á³ÖÔÚ×îµÍÏÞ¶È¡£¡£¡£¡£¡£
l ÆôÓÃÇ¿ÃÜÂëÕ½ÂÔ²¢ÉèÖÃΪ°´ÆÚÐ޸ġ£¡£¡£¡£¡£
3.4 ²Î¿¼Á´½Ó
https://www.dell.com/support/kbdoc/en-us/000216615/dsa-2023-282-security-update-for-dell-storage-integration-tools-for-vmware-dsitv-vulnerabilities
https://www.bleepingcomputer.com/news/security/dell-compellent-hardcoded-key-exposes-vmware-vcenter-admin-creds/
ËÄ¡¢°æ±¾ÐÅÏ¢
°æ±¾ | ÈÕÆÚ | ±¸×¢ |
V1.0 | 2023-08-11 | Ê×´ÎÐû²¼ |
Îå¡¢¸½Â¼
5.1 ¼øºÚµ£±£Íø¼ò½é
¼øºÚµ£±£Íø½¨ÉèÓÚ1996Ä꣬£¬£¬£¬£¬ÊÇÓÉÁôÃÀ²©Ê¿ÑÏÍû¼ÑŮʿ½¨ÉèµÄ¡¢ÓµÓÐÍêÈ«×ÔÖ÷֪ʶ²úȨµÄÐÅÏ¢Çå¾²¸ß¿Æ¼¼ÆóÒµ¡£¡£¡£¡£¡£ÊǺ£ÄÚ×î¾ßʵÁ¦µÄÐÅÏ¢Çå¾²²úÆ·¡¢Ç徲ЧÀͽâ¾ö¼Æ»®µÄÁ캽ÆóÒµÖ®Ò»¡£¡£¡£¡£¡£
¹«Ë¾×ܲ¿Î»ÓÚ±±¾©ÊÐÖйشåÈí¼þÔ°¼øºÚµ£±£Íø´óÏ㬣¬£¬£¬£¬¹«Ë¾Ô±¹¤6000ÓàÈË£¬£¬£¬£¬£¬Ñз¢ÍŶÓ1200ÓàÈË, ÊÖÒÕЧÀÍÍŶÓ1300ÓàÈË¡£¡£¡£¡£¡£ÔÚÌìϸ÷Ê¡¡¢ÊС¢×ÔÖÎÇøÉèÁ¢·ÖÖ§»ú¹¹ÁùÊ®¶à¸ö£¬£¬£¬£¬£¬ÓµÓÐÁýÕÖÌìϵÄÏúÊÛϵͳ¡¢ÇþµÀϵͳºÍÊÖÒÕÖ§³Öϵͳ¡£¡£¡£¡£¡£¹«Ë¾ÓÚ2010Äê6ÔÂ23ÈÕÔÚÉîÛÚÖÐС°å¹ÒÅÆÉÏÊС£¡£¡£¡£¡££¨¹ÉƱ´úÂ룺002439£©
¶àÄêÀ´£¬£¬£¬£¬£¬¼øºÚµ£±£ÍøÖÂÁ¦ÓÚÌṩ¾ßÓйú¼Ê¾ºÕùÁ¦µÄ×ÔÖ÷Á¢ÒìµÄÇå¾²²úÆ·ºÍ×î¼Ñʵ¼ùЧÀÍ£¬£¬£¬£¬£¬×ÊÖú¿Í»§ÖÜÈ«ÌáÉýÆäIT»ù´¡ÉèÊ©µÄÇå¾²ÐÔºÍÉú²úЧÄÜ£¬£¬£¬£¬£¬Îª´òÔìºÍÌáÉý¹ú¼Ê»¯µÄÃñ×åÐÅÏ¢Çå¾²¹¤ÒµÁì¾üÆ·ÅÆ¶ø²»Ð¸Æð¾¢¡£¡£¡£¡£¡£
5.2 ¹ØÓÚ¼øºÚµ£±£Íø
¼øºÚµ£±£ÍøÇå¾²Ó¦¼±ÏìÓ¦ÖÐÐÄÒÑÐû²¼1000¶à¸öÎó²îͨ¸æºÍΣº¦Ô¤¾¯£¬£¬£¬£¬£¬ÎÒÃǽ«Ò»Á¬¸ú×ÙÈ«Çò×îеÄÍøÂçÇå¾²ÊÂÎñºÍÎó²î£¬£¬£¬£¬£¬ÎªÆóÒµµÄÐÅÏ¢Çå¾²±£¼Ý»¤º½¡£¡£¡£¡£¡£
¹Ø×¢ÎÒÃÇ£º