DEA-3TT2 information search - Associate - Data Protection and Management Updated: 2024

Researchers have discovered several vulnerabilities inside Dell EMC's data protection products that allow attackers to gain full control of the systems.

Dell EMC's Avamar Server, NetWorker Virtual Edition, and Integrated Data Protection Appliance all contain a standard component – Avamar Installation Manager – which is vulnerable, according to new findings from the security technology and services firm Digital Defense. Researchers uncovered three vulnerabilities within Dell's data protection suite.

"Combining the three identified vulnerabilities, full compromise of the affected system is possible by modifying the configuration file," said Digital Defense, in a statement.

[Related: AMD Claims 'Near-Zero Risk' To Its Processors From Meltdown, Spectre Exploits]

Attackers could obtain information stored inside the appliances such as critical databases and server data, according to the firm. Vulnerabilities include an authentication bypass bug in the software's SecurityService and two faults in its authenticated arbitrary file access in UserInputService.

Dell EMC released security fixes to address the vulnerabilities on Friday.

In a statement to CRN, Dell said it created the security fixes and had alerted customers. "With software vulnerabilities a fact of life in the technology industry, Dell EMC follows best practices in managing and responding to security vulnerabilities in our products. Our goal is to provide customers with timely information, guidance, and mitigation to address threats from vulnerabilities," said Dell.

There was also a similar problem in VMware's vSphere Data Protection backup product, which leverages Dell EMC. The product contains an authentication bypass vulnerability that allows an attacker to bypass application authentication and gain root access to the system.

VMware released a patch earlier this week detailing the issue.

Mike Cotton, vice president of research and development at Digital Defense, said in a statement that IT teams should check their data center for these products and install the patches immediately.

After the vulnerabilities were discovered, Digital Defense and Dell EMC worked together to address the vulnerabilities and find additional product versions impacted. "This is a good example of coordinated disclosure in action," said Dell.

One top executive from a solution provider – a Dell Titanium partner – said his company was reaching out to customers on Friday.

"We're reaching out to clients with the software [fix] and offering our services already," said the executive, who declined to be identified. "These things do happen to Dell because their product set is so big, but I think Dell was extremely proactive on this one … We don't expect to take a big hit financially because of this."

The Dell EMC vulnerability comes the same week as massive security flaws were found in chips from multiple vendors that have the tech industry scrambling to protect systems around the world.

The Meltdown and Spectre security flaws, discovered by security researchers last year and publicized Wednesday by media reports, are found in chips from multiple vendors, including market leader Intel. Many of Dell solutions contain Intel processors.

In a statement to CRN, Dell said its "aware of new security research describing software analysis methods related to Intel microprocessors. We are working with Intel and others in the industry to investigate and address the issue."

© 2023 Fortune Media IP Limited. All Rights Reserved. Use of this site constitutes acceptance of our Terms of Use and Privacy Policy | CA Notice at Collection and Privacy Notice | Do Not Sell/Share My Personal Information | Ad Choices 
FORTUNE is a trademark of Fortune Media IP Limited, registered in the U.S. and other countries. FORTUNE may receive compensation for some links to products and services on this website. Offers may be subject to change without notice.
S&P Index data is the property of Chicago Mercantile Exchange Inc. and its licensors. All rights reserved. Terms & Conditions. Powered and implemented by Interactive Data Managed Solutions.

JEROME H. SALTZER, SENIOR MEMBER, IEEE, AND
MICHAEL D. SCHROEDER, MEMBER, IEEE

Invited Paper

Abstract - This tutorial paper explores the mechanics of protecting computer-stored information from unauthorized use or modification. It concentrates on those architectural structures—whether hardware or software—that are necessary to support information protection. The paper develops in three main sections. Section I describes desired functions, design principles, and examples of elementary protection and authentication mechanisms. Any reader familiar with computers should find the first section to be reasonably accessible. Section II requires some familiarity with descriptor-based computer architecture. It examines in depth the principles of modern protection architectures and the relation between capability systems and access control list systems, and ends with a brief analysis of protected subsystems and protected objects. The reader who is dismayed by either the prerequisites or the level of detail in the second section may wish to skip to Section III, which reviews the state of the art and current research projects and provides suggestions for further reading.

Glossary

The following glossary provides, for reference, brief definitions for several terms as used in this paper in the context of protecting information in computers.

Access

The ability to make use of information stored in a computer system. Used frequently as a verb, to the horror of grammarians.

Access control list

A list of principals that are authorized to have access to some object.

Authenticate

To verify the identity of a person (or other agent external to the protection system) making a request.

Authorize

To grant a principal access to certain information.

Capability

In a computer system, an unforgeable ticket, which when presented can be taken as incontestable proof that the presenter is authorized to have access to the object named in the ticket.

Certify

To check the accuracy, correctness, and completeness of a security or protection mechanism.

Complete isolation

A protection system that separates principals into compartments between which no flow of information or control is possible.

Confinement

Allowing a borrowed program to have access to data, while ensuring that the program cannot release the information.

Descriptor

A protected value which is (or leads to) the physical address of some protected object.

Discretionary

(In contrast with nondiscretionary.) Controls on access to an object that may be changed by the creator of the object.

Domain

The set of objects that currently may be directly accessed by a principal.

Encipherment

The (usually) reversible scrambling of data according to a secret transformation key, so as to make it safe for transmission or storage in a physically unprotected environment.

Grant

To authorize (q. v.).

Hierarchical control

Referring to ability to change authorization, a scheme in which the record of each authorization is controlled by another authorization, resulting in a hierarchical tree of authorizations.

List-oriented

Used to describe a protection system in which each protected object has a list of authorized principals.

Password

A secret character string used to authenticate the claimed identity of an individual.

Permission

A particular form of allowed access, e.g., permission to READ as contrasted with permission to WRITE.

Prescript

A rule that must be followed before access to an object is permitted, thereby introducing an opportunity for human judgment about the need for access, so that abuse of the access is discouraged.

Principal

The entity in a computer system to which authorizations are granted; thus the unit of accountability in a computer system.

Privacy

The ability of an individual (or organization) to decide whether, when, and to whom personal (or organizational) information is released.

Propagation

When a principal, having been authorized access to some object, in turn authorizes access to another principal.

Protected object

A data structure whose existence is known, but whose internal organization is not accessible, except by invoking the protected subsystem (q.v.) that manages it.

Protected subsystem

A collection of procedures and data objects that is encapsulated in a domain of its own so that the internal structure of a data object is accessible only to the procedures of the protected subsystem and the procedures may be called only at designated domain entry points.

Protection

1) Security (q.v.).
2) Used more narrowly to denote mechanisms and techniques that control the access of executing programs to stored information.

Protection group

A principal that may be used by several different individuals.

Revoke

To take away previously authorized access from some principal.

Security

With respect to information processing systems, used to denote mechanisms and techniques that control who may use or modify the computer or the information stored in it.

Self control

Referring to ability to change authorization, a scheme in which each authorization contains within it the specification of which principals may change it.

Ticket-oriented

Used to describe a protection system in which each principal maintains a list of unforgeable bit patterns, called tickets, one for each object the principal is authorized to have access.

User

Used imprecisely to refer to the individual who is accountable for some identifiable set of activities in a computer system.

1. Basic Principles Of Information Protection
2. Descriptor-Based Protection Systems
3. The State of the Art
4. References

   ---

5. Figures: 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14

Best identity theft services

Best overall

Runner-up

Best for credit monitoring

Best for identity theft insurance

Best for computer and device protection

Identity theft services FAQs

What do identity theft protection services do?

Identity theft protection vs. credit monitoring services

Can identity theft protection services prevent fraud?

How to prevent identity theft

Our methodology

Editorial Note: Opinions, analyses, reviews or recommendations expressed in this article are those of the Select editorial staff’s alone, and have not been reviewed, approved or otherwise endorsed by any third party.