• United States

Dell EMC patches vulnerabilities in its data protection products

News Analysis
Jan 11, 20182 mins
Data CenterDellSecurity

The vulnerabilities affect Dell EMC's Avamar Server, NetWorker Virtual Edition, and Integrated Data Protection Appliance. Users should apply patches now.

putting on a band-aid patch with binary code
Credit: Thinkstock

Researchers have discovered several vulnerabilities in Dell EMC’s data protection products that would allow an attacker to gain full control of the system. Fortunately, a fix is available now for download.

The vulnerabilities, three in all, were disclosed on Jan. 4 by the security technology and services firm Digital Defense. They effect Dell EMC’s Avamar Server, NetWorker Virtual Edition, and Integrated Data Protection Appliance, which use a common component called Avamar Installation Manager. This is the problematic app.

In addition to this, a related problem in the VMware vSphere Data Protection backup product has also been uncovered, but it has already been patched.

How attackers could exploit the vulnerabilities

Through the vulnerabilities in user authentication, attackers could obtain information stored inside the appliances, such as server data.

“The authentication bypass can be combined with the other two vulnerabilities to fully compromise the virtual appliance,” Digital Defense said in a blog post announcing the problem.

Digital Defense worked with Dell EMC on the problem and held the news until Dell EMC could issue security fixes to address the vulnerabilities, which are now out.

These patches should be applied without delay because they are quite serious. Attackers can get at database information without having to break into the actual database server. They can log in to the backup devices instead as administrators and won’t need to know any user names or passwords.

Products affected

The impacted products are:

  • Avamar Server 7.1.x, 7.2.x, 7.3.x, 7.4. x, 7.5.0
  • NetWorker Virtual Edition 0.x, 9.1.x, 9.2.x
  • Integrated Data Protection Appliance 2.0

While this has shades of the Meltdown flaw affecting CPUs, the two are entirely unrelated. It’s just a coincidental resemblance in that both allow for reading of contents on a device.

Andy Patrizio is a freelance journalist based in southern California who has covered the computer industry for 20 years and has built every x86 PC he’s ever owned, laptops not included.

The opinions expressed in this blog are those of the author and do not necessarily represent those of ITworld, Network World, its parent, subsidiary or affiliated companies.

More from this author