戴尔EMC Isilon OneFS遭受不正确的授权，跨站点请求伪造和路径穿越漏洞。

-----BEGIN PGP SIGNED MESSAGE-----Hash: SHA256DSA-2018-018: Dell EMC Isilon OneFS Multiple VulnerabilitiesDell EMC Identifier: DSA-2018-018CVE Identifier: CVE-2018-1186, CVE-2018-1187, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202, CVE-2018-1203, CVE-2018-1204, CVE-2018-1213Severity: HighSeverity Rating: CVSS Base Score: See below for CVSS v3 scoresAffected products:Dell EMC Isilon OneFS version 8.1.0.2 (CVE-2018-1213 only)Dell EMC Isilon OneFS versions between 8.1.0.0 - 8.1.0.1 (all CVEs)Dell EMC Isilon OneFS versions between 8.0.1.0 - 8.0.1.2 (all CVEs)Dell EMC Isilon OneFS versions between 8.0.0.0 - 8.0.0.6 (all CVEs)Dell EMC Isilon OneFS versions 7.2.1.x (CVE-2018-1186, CVE-2018-1188, CVE-2018-1189, CVE-2018-1201, CVE-2018-1204, CVE-2018-1213)Dell EMC Isilon OneFS version 7.1.1.11 (CVE-2018-1186, CVE-2018-1189, CVE-2018-1201, CVE-2018-1202, CVE-2018-1204, CVE-2018-1213)Summary: Dell EMC Isilon OneFS is affected by multiple security vulnerabilities that may potentially be exploited by a malicious administrator and lead to root functions within Isilon OneFS, running in compadmin mode, being compromised.Note: In Isilon OneFS, running in compadmin mode, compadmin user is less privileged than the nodes' root users.Details Incorrect Authorization Vulnerability (CVE-2018-1203)In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. The tcpdump binary, being run with sudo, may potentially be used by compadmin to execute arbitrary code with root privileges.CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)Path Traversal Vulnerability (CVE-2018-1204)Dell EMC Isilon OneFS is affected by a path traversal vulnerability in the isi_phone_home tool. A malicious compadmin may potentially exploit this vulnerability to execute arbitrary code with root privileges.CVSS v3 Base Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)Cross-Site Scripting Vulnerability in Cluster Description (CVE-2018-1186)Dell EMC Isilon is affected by a cross-site scripting vulnerability in the Cluster description of the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)?Cross-Site Scripting Vulnerability in Network Configuration Page (CVE-2018-1187)Dell EMC Isilon is affected by a cross-site scripting vulnerability in the Network Configuration page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)Cross-Site Scripting Vulnerability in Authorization Providers Page (CVE-2018-1188)Dell EMC Isilon is affected by a cross-site scripting vulnerability in the Authorization Providers page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)Cross-Site Scripting Vulnerability in Antivirus Page (CVE-2018-1189)Dell EMC Isilon is affected by a cross-site scripting vulnerability in the Antivirus Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)Cross-Site Scripting Vulnerability in Job Operations Page (CVE-2018-1201)Dell EMC Isilon is affected by a cross-site scripting vulnerability in the Job Operations Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)Cross-Site Scripting Vulnerability in NDMP Page (CVE-2018-1202)Dell EMC Isilon is affected by a cross-site scripting vulnerability in the NDMP Page within the OneFS web administration interface. A malicious administrator may potentially inject arbitrary HTML or JavaScript code in the user's browser session in the context of the OneFS website.CVSS v3 Base Score: 5.9 (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L)Cross-Site Request Forgery Vulnerability (CVE-2018-1213)Dell EMC Isilon OneFS is affected by a cross-site request forgery vulnerability. A malicious user may potentially exploit these vulnerability to send unauthorized requests to the server on behalf of authenticated users of the application.CVSS v3 Base Score: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)Resolution: The following Dell EMC Isilon OneFS maintenance releases addresses these vulnerabilities (except for CVE-2018-1213):Dell EMC Isilon OneFS 8.1.0.2Patches are available for the below versions:Patch-213283 for OneFS 8.1.0.2 (CVE-2018-1213 only)Patch-217638 for OneFS 8.1.0.1 (all CVEs)Patch-213281 for OneFS 8.1.0.0 (all CVEs)Patch-213280 for OneFS 8.0.1.2 (all CVEs)Patch-213278 for OneFS 8.0.0.6 (all CVEs)Patch-217637 for OneFS 8.0.0.5 (all CVEs)Patch-211980 for OneFS 8.0.0.4 (all CVEs)IMPORTANT: If you update Isilon OneFS with a patch from this list, and you are using Insight IQ, you must upgrade to Insight IQ 4.1.2 prior to installing the patch.Dell EMC recommends that all customers upgrade to a version or patch which addresses these vulnerabilities at the earliest opportunity.This advisory will be updated when fixes are available for additional versions.Link To Remedies: Registered Dell EMC Online Support customers can download OneFS installation files from the Downloads for Isilon OneFS page of the Dell EMC Online Support site at  you have any questions, contact Dell EMC Support.Credit:Dell EMC would like to thank Ivan Huertas and Maximiliano Vidal from Core Security Consulting Services for reporting these vulnerabilities.-----BEGIN PGP SIGNATURE-----Version: GnuPG v2iQEcBAEBCAAGBQJar7X8AAoJEHbcu+fsE81ZnVsH/RkfP2XUz4sHV2uQofuZR2bJ319oyT9XVWUsOwCtQQ2ty/rolXHlO/B1viIq5OYJo4sTrN9s8dupz/Patek9HdiTRR0nvSVEgLM4C8NwB30hwJO8luuO8RDQUc3BQnSo6Vy8b1zM9F7A+yMZgseUoOaWu5jduNB8kvTAAyK4SnujqyBE4eT193x2yxAr15VoMRNFlmmu+S8GHpcCMoE0CDRt05zhC6wCelN9BA0Bf7D533ffigfP8QAe+zw/OaQgQcEmoe5ys9aaHp2EJaAF5UZNEh5JtXuwGX3dq0GDdVgbrA0ZlQlLConpBHhZEoIn99YF4MHpbp9l3QbeEYUS2ko==c/8F-----END PGP SIGNATURE-----