White Papers

7 Improved Server Security with iDRAC9 and SELinux
3 Customer impact
Together, these two initiatives offer defense against security threats and malicious attacks against iDRAC9.
These security measures result in better protection of customer’s assets. Adding SELinux is a proactive
measure to increase security of Dell EMC embedded systems management tools.
However, it should be noted that SELinux constrains and mitigates certain classes of exploits but does not
prevent them. An analogy would be that if a vulnerability is exploited, SELinux confines the attacker to a very
limited safe room and makes it more difficult for an attacker to fully compromise the system. A system with
SELinux is much harder to break into when compared to a system without SELinux. Some of the
vulnerabilities can be mitigated effectively by SELinux, including the following:
• Shellshock
• A few recent Samba privilege escalation and remote code execution attacks
• A few Apache privilege escalation and path traversal
Dell EMC is proactive in implementing security measures. Instead of waiting for vulnerabilities to be
discovered and then patching them, Dell EMC now implements SELinux and ‘non-root least privileges’ to
provide restricted and authorized access, thereby limiting what attackers can do. SELinux is best-of-breed
security to protect the system in the event of an attack. It can confine behavior of attackers, mitigate the
consequences of a security breach, and potentially turn what could be a catastrophic breach into a minor one.
3.1 Security considerations
If we test historical security vulnerabilities in a system with non-root access and SELinux enabled, we see the
types of attacks or security issues that these initiatives can be expected to prevent. These tests also help in
identifying the types of security issues that are not addressed.
In the following sections, a few examples of security issue found in previous versions of iDRAC are listed. The
list also provides details on how these security initiatives helped in mitigating those issues. As with any
security technology, SELinux and non-root are not panaceas, and cannot protect against every conceivable
flaw. Therefore, we also give examples of some historical vulnerabilities that cannot be mitigated with
SELinux and non-root access.
3.2 Security issues mitigated by SELinux and non-root privilege
Following is a list of some of the vulnerabilities found in previous generation of iDRAC. SELinux can either
partially or fully mitigate these issues. Details are also provided about impact if the same vulnerabilities are
encountered in iDRAC9. The intent is to show examples of vulnerabilities that SELinux mitigates fully or
partially, and the ones that it cannot mitigate. These issues have been addressed in the latest releases of
iDRAC.
• CVE-2018-1207: Dell EMC iDRAC7/8
Versions earlier than iDRAC 2.52.52.52 contain CGI injection vulnerability that could be used to
execute remote code. A remote unauthenticated attacker may potentially be able to use CGI
variables to execute remote code.
• CVE-2018-1207: Dell EMC iDRAC9
CGI injection vulnerability in iDRAC7/8 could allow an attacker to execute arbitrary OS
commands on iDRAC because the CGI scripts used to run with root privileges. If a similar
injection vulnerability is found in iDRAC9, the impact would be greatly reduced. With SELinux