Skip to main content
Sign Out

Welcome to Dell

My Account
  • Place orders quickly and easily
  • View orders and track your shipping status
  • Create and access a list of your products
  • Manage your Dell EMC sites, products, and product-level contacts using Company Administration.
Sign In Create an Account Premier Sign In Partner Program Sign In
Contact Us

Your Dell.com Baskets

Some article numbers may have changed. If this isn't what you're looking for, try searching all articles. Search articles

Article Number: 000211267

DSA-2023-060: Dell NetWorker Security Update for an nsrcapinfo Vulnerability.

Summary: Dell NetWorker remediation is available for nsrcapinfo with option -c, -s vulnerability that could be exploited by malicious users to compromise the affected system.

Article Content

Impact

Critical

Details

Proprietary Code CVE(s)
 		 Description CVSS Base Score CVSS Vector String
CVE-2023-25539 Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. This is a high severity vulnerability as the exploitation allows an attacker to take complete control of a system, so Dell recommends customers to upgrade at the earliest opportunity. 9.1
 		 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HThis hyperlink is taking you to a website outside of Dell Technologies. 
Proprietary Code CVE(s)
 		 Description CVSS Base Score CVSS Vector String
CVE-2023-25539 Dell NetWorker 19.6.1.2, contains an OS command injection Vulnerability in the NetWorker client. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. This is a high severity vulnerability as the exploitation allows an attacker to take complete control of a system, so Dell recommends customers to upgrade at the earliest opportunity. 9.1
 		 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HThis hyperlink is taking you to a website outside of Dell Technologies. 
Dell Technologies recommends all customers consider both the CVSS base score and any relevant temporal and environmental scores that may impact the potential severity associated with a particular security vulnerability.

Affected Products and Remediation

CVE(s) Addressed
 		 Product Affected Version(s) Updated Version(s) Link to Update
CVE-2023-25539 Dell NetWorker
NVE
 		 NetWorker 19.6.1.2 Linux and prior releases
NetWorker
19.7.0.3 Linux and prior releases,
19.7.1 Linux		 19.8.0.1 & Later releases

19.7.0.4 & Later releases		 https://www.dell.com/support/home/en-ca/product-support/product/networker/drivers
 
 





CVE(s) Addressed
 		 Product Affected Version(s) Updated Version(s) Link to Update
CVE-2023-25539 Dell NetWorker
NVE
 		 NetWorker 19.6.1.2 Linux and prior releases
NetWorker
19.7.0.3 Linux and prior releases,
19.7.1 Linux		 19.8.0.1 & Later releases

19.7.0.4 & Later releases		 https://www.dell.com/support/home/en-ca/product-support/product/networker/drivers
 
 





The impacted component is NetWorker client and the affected platforms are Linux (CentOS, OEL, SuSE, RHEL, Debian, Ubuntu, Fedora).

Acknowledgements

Dell Technologies would like to thank Maciej Kosz for reporting this issue.

Revision History

RevisionDateDescription
1.02023-04-03Initial Release
2.02023-05-11Made changes to Updated Versions
3.02023-06-06Made changes to "Impact", "CVSS Base Score" & "CVSS Vector String"

Related Information

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Legal Information

Article Properties

Affected Product

NetWorker Family, NetWorker, NetWorker Series, NetWorker Module, Product Security Information

Last Published Date

06 Jun 2023

Version

4

Article Type

Dell Security Advisory

Back to Top