Dell patches vProxy third-party vulnerabilities

Dell has issued patches for three third-party components used in its NetWorker vProxy appliance, the most severe of which is rated critical.

The patches cover two vulnerabilities in OpenSSH, and one each in Vim and Intel processor microcode.

The critical-rated CVE-2023-38408 in OpenSSH was disclosed in July 2023.

It’s a bug in the software’s implementation of the Public-Key Cryptography Standards (PKCS) #11 API, used to communicate with hardware-based security tokens such as smart cards.

The feature “has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system," Dell’s advisory explained.

The bug has previously been patched by Oracle, OpenBSD, Debian, Fedora, Gentoo, NetApp, and Apple.

The second OpenSSH bug, CVE-2023-48795, is only rated medium-severity; it’s a mishandling of handshakes that potentially allows connections with downgraded security features.

CVE-2023-5344 is a locally attackable bug in the Vim text editor. Rated as high severity, it’s a heap-based buffer overflow.

The fourth patch from Intel, CVE-2023-23583, is a high-severity vulnerability in the microcode of some processors, opening potential local privilege escalation, information disclosure, or denial of service attacks.