Dell patches vProxy third-party vulnerabilities

Dell has issued patches for three third-party components used in its NetWorker vProxy appliance, the most severe of which is rated critical.

The patches cover two vulnerabilities in OpenSSH, and one each in Vim and Intel processor microcode.

The critical-rated CVE-2023-38408 in OpenSSH was disclosed in July 2023.

It’s a bug in the software’s implementation of the Public-Key Cryptography Standards (PKCS) #11 API, used to communicate with hardware-based security tokens such as smart cards.

The feature “has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system,” Dell’s advisory explained.

The bug has previously been patched by Oracle, OpenBSD, Debian, Fedora, Gentoo, NetApp, and Apple.

The second OpenSSH bug, CVE-2023-48795, is only rated medium-severity; it’s a mishandling of handshakes that potentially allows connections with downgraded security features.

CVE-2023-5344 is a locally attackable bug in the Vim text editor. Rated as high severity, it’s a heap-based buffer overflow.

The fourth patch from Intel, CVE-2023-23583, is a high-severity vulnerability in the microcode of some processors, opening potential local privilege escalation, information disclosure, or denial of service attacks.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts