Category: Dell

How to Enable a Pre-Boot BitLocker PIN on Windows

If you encrypt your Windows system drive with BitLocker, you can add a PIN for additional security. You’ll need to enter the PIN each time you turn on your PC, before Windows will even start. This is separate from a login PIN, which you enter after Windows boots up.

RELATED: How to Use a USB Key to Unlock a BitLocker-Encrypted PC

A pre-boot PIN prevents the encryption key from automatically being loaded into system memory during the boot process, which protects against direct memory access (DMA) attacks on systems with hardware vulnerable to them. Microsoft’s documentation explains this in more detail.

Step One: Enable BitLocker (If You Haven’t Already)

RELATED: How to Set Up BitLocker Encryption on Windows

This is a BitLocker feature, so you have to use BitLocker encryption to set a pre-boot PIN. This is only available on Professional and Enterprise editions of Windows. Before you can set a PIN, you have to enable BitLocker for your system drive.

Note that, if you go out of your way to enable BitLocker on a computer without a TPM, you’ll be prompted to create a startup password that’s used instead of the TPM. The below steps are only necessary when enabling BitLocker on computers with TPMs, which most modern computers have.

If you have a Home version of Windows, you won’t be able to use BitLocker. You may have the Device Encryption feature instead, but this works differently from BitLocker and doesn’t allow you to provide a startup key.

Step Two: Enable the Startup PIN in Group Policy Editor

Once you’ve enabled BitLocker, you’ll need to go out of your way to enable a PIN with it. This requires a Group Policy settings change. To open the Group Policy Editor, press Windows+R, type “gpedit.msc” into the Run dialog, and press Enter.

Head to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives in the Group Policy window.

Double-click the “Require Additional Authentication at Startup” Option in the right pane.

Select “Enabled” at the top of the window here. Then, click the box under “Configure TPM Startup PIN” and select the “Require Startup PIN With TPM” option. Click “OK” to save your changes.

Step Three: Add a PIN to Your Drive

You can now use the manage-bde command to add the PIN to your BitLocker-encrypted drive.

To do this, launch a Command Prompt window as Administrator. On Windows 10 or 8, right-click the Start button and select “Command Prompt (Admin)”. On Windows 7, find the “Command Prompt” shortcut in the Start menu, right-click it, and select “Run as Administrator”

Run the following command. The below command works on your C: drive, so if you want to require a startup key for another drive, enter its drive letter instead of c: .

manage-bde -protectors -add c: -TPMAndPIN

You’ll be prompted to enter your PIN here. The next time you boot, you’ll be asked for this PIN.

To double-check whether the TPMAndPIN protector was added, you can run the following command:

manage-bde -status

(The “Numerical Password” key protector displayed here is your recovery key.)

How to Change Your BitLocker PIN

To change the PIN in the future, open a Command Prompt window as Administrator and run the following command:

manage-bde -changepin c:

You’ll need to type and confirm your new PIN before continuing.

How to Remove the PIN Requirement

If you change your mind and want to stop using the PIN later, you can undo this change.

First, you’ll need to head to the Group Policy window and change the option back to “Allow Startup PIN With TPM”. You can’t leave the option set to “Require Startup PIN With TPM” or Windows won’t allow you to remove the PIN.

Next, open a Command Prompt window as Administrator and run the following command:

manage-bde -protectors -add c: -TPM

This will replace the “TPMandPIN” requirement with a “TPM” requirement, deleting the PIN. Your BitLocker drive will automatically unlock via your computer’s TPM when you boot.

To check that this completed successfully, run the status command again:

manage-bde -status c:

If you forget the PIN, you’ll need to provide the BitLocker recovery code you should have saved somewhere safe when you enabled BitLocker for your system drive.

Source :
https://www.howtogeek.com/262720/how-to-enable-a-pre-boot-bitlocker-pin-on-windows/

CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added the recently disclosed remote code execution (RCE) vulnerability affecting the Spring Framework, to its Known Exploited Vulnerabilities Catalog based on “evidence of active exploitation.”

The critical severity flaw, assigned the identifier CVE-2022-22965 (CVSS score: 9.8) and dubbed “Spring4Shell”, impacts Spring model–view–controller (MVC) and Spring WebFlux applications running on Java Development Kit 9 and later.

“Exploitation requires an endpoint with DataBinder enabled (e.g., a POST request that decodes data from the request body automatically) and depends heavily on the servlet container for the application,” Praetorian researchers Anthony Weems and Dallas Kaman noted last week.

Although exact details of in-the-wild abuse remain unclear, information security company SecurityScorecard said “active scanning for this vulnerability has been observed coming from the usual suspects like Russian and Chinese IP space.”

Similar scanning activities have been spotted by Akamai and Palo Alto Networks’ Unit42, with the attempts leading to the deployment of a web shell for backdoor access and to execute arbitrary commands on the server with the goal of delivering other malware or spreading within the target network.

“During the first four days after the vulnerability outbreak, 16% of the organizations worldwide were impacted by exploitation attempts,” Check Point Research said, adding it detected 37,000 Spring4Shell-related attacks over the weekend.

Microsoft 365 Defender Threat Intelligence Team also chimed in, stating it has been “tracking a low volume of exploit attempts across our cloud services for Spring Cloud and Spring Core vulnerabilities.”

According to statistics released by Sonatype, potentially vulnerable versions of the Spring Framework account for 81% of the total downloads from Maven Central repository since the issue came to light on March 31.

Cisco, which is actively investigating its line-up to determine which of them may be impacted by the vulnerability, confirmed that three of its products are affected –

  • Cisco Crosswork Optimization Engine
  • Cisco Crosswork Zero Touch Provisioning (ZTP), and
  • Cisco Edge Intelligence

VMware, for its part, also has deemed three of its products as vulnerable, offering patches and workarounds where applicable –

  • VMware Tanzu Application Service for VMs
  • VMware Tanzu Operations Manager, and
  • VMware Tanzu Kubernetes Grid Integrated Edition (TKGI)

“A malicious actor with network access to an impacted VMware product may exploit this issue to gain full control of the target system,” VMware said in the advisory.

Also added by CISA to the catalog are two zero-day flaws patched by Apple last week (CVE-2022-22674 and CVE-2022-22675) and a critical shortcoming in D-Link routers (CVE-2021-45382) that has been actively weaponized by the Beastmode Mirai-based DDoS campaign.

Pursuant to the Binding Operational Directive (BOD) issued by CISA in November 2021, Federal Civilian Executive Branch (FCEB) agencies are required to remediate the identified vulnerabilities by April 25, 2022.

Source :
https://thehackernews.com/2022/04/cisa-warns-of-active-exploitation-of.html

VMware Releases Critical Patches for New Vulnerabilities Affecting Multiple Products

VMware has released security updates to patch eight vulnerabilities spanning its products, some of which could be exploited to launch remote code execution attacks.

Tracked from CVE-2022-22954 to CVE-2022-22961 (CVSS scores: 5.3 – 9.8), the issues impact VMware Workspace ONE Access, VMware Identity Manager, VMware vRealize Automation, VMware Cloud Foundation, and vRealize Suite Lifecycle Manager.

Five of the eight bugs are rated Critical, two are rated Important, and one is rated Moderate in severity. Credited with reporting all the vulnerabilities is Steven Seeley of Qihoo 360 Vulnerability Research Institute.

The list of flaws is below –

  • CVE-2022-22954 (CVSS score: 9.8) – Server-side template injection remote code execution vulnerability affecting VMware Workspace ONE Access and Identity Manager
  • CVE-2022-22955 & CVE-2022-22956 (CVSS scores: 9.8) – OAuth2 ACS authentication bypass vulnerabilities in VMware Workspace ONE Access
  • CVE-2022-22957 & CVE-2022-22958 (CVSS scores: 9.1) – JDBC injection remote code execution vulnerabilities in VMware Workspace ONE Access, Identity Manager, and vRealize Automation
  • CVE-2022-22959 (CVSS score: 8.8) – Cross-site request forgery (CSRF) vulnerability in VMware Workspace ONE Access, Identity Manager, and vRealize Automation
  • CVE-2022-22960 (CVSS score: 7.8) – Local privilege escalation vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation, and
  • CVE-2022-22961 (CVSS score: 5.3) – Information disclosure vulnerability impacting VMware Workspace ONE Access, Identity Manager and vRealize Automation

Successful exploitation of the aforementioned weaknesses could allow a malicious actor to escalate privileges to root user, gain access to the hostnames of the target systems, and remotely execute arbitrary code, effectively allowing full takeover.

“This critical vulnerability should be patched or mitigated immediately,” VMware said in an alert. “The ramifications of this vulnerability are serious.”

While the virtualization services provider noted that it has not seen any evidence that the vulnerabilities have been exploited in the wild, it’s highly recommended to apply the patches to remove potential threats.

“Workarounds, while convenient, do not remove the vulnerabilities, and may introduce additional complexities that patching would not,” the company cautioned.

Source :
https://thehackernews.com/2022/04/vmware-releases-critical-patches-for.html

New Dell BIOS Bugs Affect Millions of Inspiron, Vostro, XPS, Alienware Systems

Five new security weaknesses have been disclosed in Dell BIOS that, if successfully exploited, could lead to code execution on vulnerable systems, joining the likes of firmware vulnerabilities recently uncovered in Insyde Software’s InsydeH2O and HP Unified Extensible Firmware Interface (UEFI).

Tracked as CVE-2022-24415, CVE-2022-24416, CVE-2022-24419, CVE-2022-24420, and CVE-2022-24421, the high-severity vulnerabilities are rated 8.2 out of 10 on the CVSS scoring system.

“The active exploitation of all the discovered vulnerabilities can’t be detected by firmware integrity monitoring systems due to limitations of the Trusted Platform Module (TPM) measurement,” firmware security company Binarly, which discovered the latter three flaws, said in a write-up.

“The remote device health attestation solutions will not detect the affected systems due to the design limitations in visibility of the firmware runtime.”

All the flaws relate to improper input validation vulnerabilities affecting the System Management Mode (SMM) of the firmware, effectively allowing a local authenticated attacker to leverage the system management interrupt (SMI) to achieve arbitrary code execution.

System Management Mode refers to a special-purpose CPU mode in x86 microcontrollers that’s designed for handling system-wide functions like power management, system hardware control, thermal monitoring, and other proprietary manufacturer-developed code.

Whenever one of these operations is requested, a non-maskable interrupt (SMI) is invoked at runtime, which executes SMM code installed by the BIOS. Given that SMM code executes at the highest privilege level and is invisible to the underlying operating system, the method makes it ripe for abuse to deploy persistent firmware implants.

A number of Dell products, including Alienware, Inspiron, Vostro line-ups, and Edge Gateway 3000 Series, are impacted, with the Texas-headquartered PC manufacturer recommending customers to upgrade their BIOS at the “earliest opportunity.”

“The ongoing discovery of these vulnerabilities demonstrate what we describe as ‘repeatable failures’ around the lack of input sanitation or, in general, insecure coding practices,” Binarly researchers said.

“These failures are a direct consequence of the complexity of the codebase or support for legacy components that get less security attention, but are still widely deployed in the field. In many cases, the same vulnerability can be fixed over multiple iterations, and still, the complexity of the attack surface leaves open gaps for malicious exploitation.”

Source :
https://thehackernews.com/2022/03/new-dell-bios-bugs-affect-millions-of.html

What Is VMware Horizon and How Does It Work?

Businesses today have been forced to switch to remote working to ensure continued business continuity. After the pandemic began in early 2020, it caused a shift to a majority remote workforce, seemingly overnight. With the change to a distributed workforce, new requirements have emerged for businesses around availability, security, and flexibility.

Virtual Desktop Infrastructure (VDI) is a solution that allows connecting remote workers with virtual desktops and applications running in a corporate data center. VMware Horizon is a VDI solution offered by VMware that provides a robust feature set and capabilities for remote workers. So what is VMware Horizon, and how does it work?

What is VMware Horizon?

Today, the work from anywhere model is no longer optional for businesses. Providing accessibility, flexibility, and connectivity from anywhere for the distributed workforce allows remote employees to remain productive no matter where they are located.

As the pandemic escalated, businesses quickly found legacy on-premises desktop and app virtualization platforms that predated the widespread use of the cloud were not equipped for current challenges. It led to many companies struggling to provide the distributed workforce with fast and reliable access to apps they need for business productivity.

VMware Horizon is an end-to-end solution for managing and delivering virtualized or physical desktops and virtual application delivery to end-users. It allows creating and brokering connections to Windows & Linux virtual desktops, Remote Desktop Services (RDS) applications, and desktops. It can also deliver Linux-hosted applications.

VMware Horizon is a Virtual Desktop Infrastructure (VDI) solution, a core component of VMware’s digital workspace for businesses looking to deliver virtual desktops and applications to their workforce. It provides the tooling and capabilities that enable access from any device and is deeply integrated with other VMware solutions and services such as VMware NSX, VMware Workspace One, vSAN, and others.

VMware Horizon provides secure and robust connectivity for remote workers


VMware Horizon provides secure and robust connectivity for remote workers

Recent VMware Horizon versions have evolved to provide desktop resources on-premises, in the cloud, hybrid clouds, and multi-cloud environments.

VMware Horizon Editions

VMware Horizon is provided in three editions:

  • Horizon Standard
  • Horizon Advanced
  • Horizon Enterprise

All three editions provide the components needed for end-to-end virtual desktop deployment.

What are the key capabilities / features of VMware Horizon?

  • VMware Horizon is a flexible and agile hybrid cloud platform.
  • It enables businesses to utilize existing datacenter based resources, including transforming on-premises desktop and app environments without redeploying.
  • It provides the ability to leverage the cloud for additional capacity and use cases
  • Choose if and when you transition workloads to optimize performance and lower the cost of on-premises environments.
  • It lets you leverage cloud-native control plane services. As a result, it reduces costs, improves productivity, and shifts IT focus from manual tasks to automated processes.
  • Manage and monitor your deployment from one central management GUI.
  • It offers the ability to meet remote user needs keeping employees connected to desktops and apps from anywhere and any device with a single login. It doesn’t matter where the data resides, on-premises or in the cloud.
  • The Horizon control plane delivers the ability to deploy, manage, and scale, virtual desktops, and apps across hybrid cloud environments.
  • Horizon is a modern platform for securely delivering virtual desktops and apps across the hybrid cloud, keeping employees connected, productive and engaged, anytime and anywhere.

Deliver applications and desktops automatically and in real-time

One of the key benefits and use cases of VMware Horizon is to deliver applications and desktops automatically and in real-time. Today, many organizations are using VMware Horizon as the vehicle that allows remote workers to connect to virtual machine resources or physical workstations in the corporate network, without VPN, or exposing an RDP server to the outside world.

Administrators configure desktop pools consisting of a single desktop or multiple desktops that end-users can connect to and utilize. When there are multiple virtual machines or physical desktops in a single pool, users will be placed on an available desktop resource in the pool.

Desktop pools consist of:

  • Automated desktop pools – An automated desktop pool uses a vCenter Server template or virtual machine snapshot to generate new machines. The machines can be created when the pool is created or generated on demand based on pool usage.
  • Manual desktop pools – A manual desktop pool provides access to an existing set of machines. Any machine that can install the VMware Horizon agent is supported. These include both vCenter virtual machines and physical desktops.
  • RDS Desktop pools – A Microsoft RDS desktop pool provides RDS sessions as machines to Horizon users. The Horizon Connection Server manages the RDS sessions in the same way as normal machines. Microsoft RDS hosts are supported on vCenter virtual machines and physical computers.
Viewing VMware Horizon Desktop Pools


Viewing VMware Horizon Desktop Pools

Application Pools provide remote workers with access to published applications, either from a desktop pool or RDS farm.

Viewing a published application in VMware Horizon


Viewing a published application in VMware Horizon

It also allows quickly performing maintenance tasks such as enabling or disabling specific Horizon Connection Servers and performing backup operations. You can also add vCenter Server environments and integrate your Unified Access Gateways to the environment.

Performing maintenance operations in the VMware Horizon Administration Console


Performing maintenance operations in the VMware Horizon Administration Console

Simplify management and maintenance tasks

One of the key areas that VMware Horizon provides quick time to value is the area of management and maintenance. The VMware Horizon Administration Console is an HTML 5 web console that is quick and intuitive. All of the tasks are very wizard-driven with natural workflows.

In the VMware Horizon Administration Console, administrators can easily see:

  • Problem vCenter VMs
  • Problem RDS hosts
  • Events
  • System Health

The VMware Horizon Monitoring dashboard quickly shows the overall system health, sessions, workload, VDI desktops, RDSH desktops, RDSH applications, and other information.

Viewing the VMware Horizon monitoring dashboard


Viewing the VMware Horizon monitoring dashboard

Keep sensitive data safe and enforce endpoint compliance

Several tools and VMware Horizon configurations help keep business-critical and sensitive data safe and enforce endpoint compliance. For example, the Endpoint Compliance Checks feature is part of the Unified Access Gateway (UAG) that provides a layer of security for clients accessing Horizon resources. The Endpoint Compliance Checks helps to verify end-user client compliance to predefined policies. These may include antivirus policy or encryption policy on endpoints.

Currently, a couple of endpoint compliance check providers offer the ability to check compliance of endpoints. These include:

  • OPSWAT – The OPSWAT MetaAccess persistent agent or the OPSWAT MetaAccess on-demand agent on the Horizon Client communicates the compliance status to an OPSWAT instance. It can then enforce policies related to the health of the endpoint and the allowed access to Horizon resources
OPSWAT Endpoint Compliance Checks


OPSWAT Endpoint Compliance Checks

  • Workspace ONE Intelligence (Risk Analytics) – The Workspace ONE Intelligence platform has a risk analytics feature. It can assess both user and device risk by identifying behaviours that affect security and calculating a risk score for each device and user. Based on the risk score, policies can define whether or not clients can connect and access resources.

End-user components

There are only a couple of different components required for end-user clients for VMware Horizon. Actually, you can use either a browser to connect to the Horizon environment or the VMware Horizon Client. Most modern clients feature an HTML5-capable browser that allows connecting to VMware Horizon.

While you can connect to VMware Horizon-enabled endpoints using a web browser, the most robust connection experience is provided with the VMware Horizon Client. However, a question often comes up with the VMware Horizon Client – is it free?

The VMware Horizon Client is indeed a free download from the VMware Customer Connect portal. Also, there is no need to provide an email address and sign up for an account. You can find the most recent download of the VMware Horizon Clients here:

Downloading the VMware Horizon Client


Downloading the VMware Horizon Client

The availability and ease of downloading the VMware Horizon Client help to ensure remote workers can easily download, install, and connect to VMware Horizon resources. Another great feature built into the VMware Horizon Client is checking for and updating the client directly from the interface.

Checking for updates to VMware Horizon Client


Checking for updates to VMware Horizon Client

When remote workers browse to the public URL of the Unified Access Gateway, the UAG presents the Horizon Connection Server web page, allowing users to download the client or connect to their assigned resources using the VMware Horizon HTML access link.

Browsing to the VMware Horizon web access


Browsing to the VMware Horizon web access

VMware Workspace ONE UEM additional components

Organizations using cloud-based VMware Workspace ONE can simplify access to the cloud, mobile, and enterprise applications from various types of devices. Workspace ONE Unified Endpoint Management (UEM) is a single solution for modern, over-the-air management of desktops, mobile, rugged, wearables, and IoT.

Supported devices with Workspace ONE UEM

It manages and secures devices and apps, taking advantage of native MDM capabilities in IOS and Android and the mobile-cloud management efficiencies found in modern versions of Windows, Mac, and Chrome OS.

Supported devices with Workspace ONE UEM

Managing clients with Workspace ONE UEM requires the Workspace ONE UEM agent is installed on the devices for management. It can be installed manually, scripted installations, or by using GPOs. Organizations can also make use of the Workspace ONE Intelligent Hub for an easily integrated digital workspace solution designed to improve employee engagement and productivity through a single app.

Read more about VMware Workspace ONE Intelligent Hub here:

The New Naming Format for VMware Horizon 8

VMware has departed a bit from the conventional naming convention associated with legacy versions of VMware Horizon previously. While the older versions of VMware Horizon were named according to a “major.minor” release name, VMware has adopted a release cadence style “YYMM” naming convention, denoting the year and month of the release, much like other software vendors have adopted in the last couple of years.

VMware Horizon 8 is denoted with a new naming convention in the YYMM format


VMware Horizon 8 is denoted with a new naming convention in the YYMM format

If you see any of the VMware Horizon versions that start with at least a “20,” these are synonymous with VMware Horizon 8 across various documentation.

Is VMware Horizon a VPN?

There are many ways that enterprise organizations have traditionally delivered access to internal resources for remote employees. Virtual Private Network (VPN) has historically been a prevalent and familiar way for end-users to access business-critical resources that reside on the internal corporate network from the Internet.

While VPN is more secure than simply placing internal resources accessible directly from the Internet (not recommended), it also has its share of security issues. With VPN connections, a VPN client is loaded on the client workstation, laptop, or other devices, creating a secure, encrypted tunnel between the client and a VPN terminator, such as a firewall or other VPN device.

VPNs traditionally have been used for remote connectivity


VPNs traditionally have been used for remote connectivity

While this secures and encrypts the communication between the client and the internal network, it essentially makes the end-user device part of the network. You can think of a VPN connection as simply a “long patch cable” between the corporate network switch and the client. There are ways to secure VPN connections and scope down the resources the external clients can see. However, it opens the door to potentially connecting a client with malware to the corporate network. It also creates the possibility of easy data exfiltration from the corporate network to the client.

VPN connections are also notoriously complex and cumbersome to manage and maintain. Admins must manage each VPN client individually in most cases. In addition, each VPN connection is its own tunnel to the corporate network, creating the need for tedious management of multiple tunnels.

VMware Horizon provides a solution that is not VPN-based and solves the challenges mentioned above with traditional VPN connections. Note the following:

  • Remote users connect to virtual or physical desktops that are provisioned inside the corporate network. It means the end-user remote client is not directly connected to the corporate network
  • While the Horizon Client is recommended for the most robust experience connecting to the VMware Horizon environment, end-users can also connect to provisioned resources over a simple web browser connection, with no client required.
  • VPNs may not work with all types of devices. VMware Horizon connectivity, either via the Horizon Client or web browser connection, means almost any modern device with web connectivity can allow a user to connect to VMware Horizon resources
  • Admins have a consolidated and centrally managed set of infrastructure as a connectivity point, either with the Unified Access Gateways (recommended for secure external connectivity) or the Horizon Connection Servers
  • Combined with VMware NSX-T Data Center, administrators can easily secure the connectivity between VMware Horizon resources and which resources users can hit, making it an identity-driven solution

VMware Anywhere Workspace

VMware Horizon is a core component of the VMware Anywhere Workspace. What is the VMware Anywhere Workspace? It is a holistic solution that combines multiple components required for effective and efficient secure remote access, including:

  • Digital workspace solution – Provided by VMware Horizon cloud services or on-premises resources
  • Endpoint security – Organizations can seamlessly secure their remote worker interface with VMware NSX-T Data Center and VMware Carbon Black.
  • Secure Access Service Edge (SASE) – Secure access service edge platform that converges industry-leading cloud networking and cloud security to deliver flexibility, agility, security, and scale for enterprise environments of all sizes.

Note how VMware Horizon fits into the various aspects of VMware Anywhere Workspace:

  • It helps to manage multi-modal employee experience – With the VMware Anywhere Workspace, VMware Horizon can help deliver a familiar desktop and application experience across workspace locations and devices.
  • Security and the distributed edge – VMware Horizon delivers access to desktops and applications to any endpoint.
  • Anywhere Workspace Integrations – Workspace SEcurity brings Carbon Black together with Workspace ONE UEM and VMware Horizon

VMware Horizon Architecture and Logical Components

VMware Horizon has a robust architecture that is compromised of many different components that make up the end-to-end solution. The components of VMware Horizon architecture include:

  • Horizon Client – The client is the piece that forms the protocol session connection to a Horizon Agent running in a virtual desktop, RDSH server, or physical machine
  • Universal Access Gateway (UAG) – It provides secure edge services for the Horizon Client. The Horizon Client authenticates to a Connection Server through the Unified Access Gateway and then forms a protocol session connection to the UAG and then the Horizon Agent running in a virtual desktop or RDSH server.
  • Horizon Connection Server – The Connection Server brokers and connects users to the Horizon Agent installed on VMs, physical hosts, and RDSH servers. The Connection Server authenticates user sessions through Active Directory, and grants access to the proper entitled resource.
  • Horizon Agent – The agent is installed in the guest OS of the target VM or system. It allows the machine to be managed by the Connection Servers and allows a Horizon Client to connect using the protocol session to the Horizon Agent.
  • RDSH Server – Microsoft Remote Desktop Servers that provide access to published applications and session-based remote desktops to end-users.
  • Virtual Machine – Virtual machines can be configured as persistent or non-persistent desktops. Persistent desktops are usually assigned in a 1-to-1 fashion to a specific user. Non-persistent desktops are assigned in desktop pools that can be dynamically provisioned to users as needed.
  • Physical Desktop – Counterintuitively, VMware Horizon can be used as a secure and efficient way to deliver connectivity to physical desktops to end-users. Starting with VMware Horizon 7.7, VMware introduced the ability to broker physical desktop machines with RDP. In Horizon 7.12, support was added for Blast protocol connectivity to physical desktops.
  • Virtual Application – Horizon can be used with RDSH servers to provide virtual application delivery. Using the functionality of the published application in RDSH, VMware Horizon can deliver the published applications to assigned users.

Logical Components

There are other components of Horizon architecture that are considered to be logical components of the solution. Some of the components listed below are not absolutely required. However, they can be used to enhance a Horizon deployment and scale the capabilities, security, and performance of the solution.

  • Workspace ONE Access – VMware Workspace ONE provides the solution for enterprise single sign-on (SSO) for the enterprise. It simplifies the access to apps, desktops, and other resources to the end-user. It can integrate with existing identity providers and provide a seamless login experience to create a smooth access workflow. It also offers application provisioning, a self-service catalogue, and conditional access.
  • App Volumes Manager – VMware App Volumes Manager coordinates and orchestrates the delivery of applications by managing assignments of application volumes. These include packages and writable volumes that can easily assign applications to users, groups, and target computers.
  • Dynamic Environment Manager – User profiles are also challenging in dynamic environments with multiple resources accessed by a single user. Dynamic Environment Manager enables seamless profile management by capturing user settings for the operating system and also end-user applications.
  • VMware vSAN™ storage – VMware vSAN is a software-defined storage solution that offers many advantages in the enterprise. It can deliver high-performance, highly-scalable storage that can be seamlessly managed from the vSphere Client as part of the native VMware solution. It does this by aggregating locally attached storage in each ESXi host in the vSphere cluster and presenting it as a logical volume for virtual machines and modern workloads. When it comes to VMware Horizon environments that are mission-critical, you want to have highly-resilient storage that is scalable and performant. VMware Horizon environments backed by VMware vSAN work exceptionally well for this use case.
  • VMware NSX-T Data Center – Another consideration for VMware Horizon environments and end-user computing is security. VMware NSX-T Data Center provides the network-based security needed in EUC environments. It allows easily creating secure, resilient, and software-defined networks that allow admins to take advantage of micro-segmentation for VMware Horizon workloads. Each virtual desktop can be isolated from all other virtual desktops using VMware NSX-T Data Center, bolstering security and protecting other critical Horizon infrastructure, such as the Connection Servers.
  • Microsoft SQL Servers – It is recommended to have a dedicated Microsoft SQL Server to house the event databases required by VMware Horizon. Plan your VMware Horizon deployment accordingly.

Horizon Hybrid and Multicloud Architecture

VMware Horizon can be deployed in many different architecture designs. These include on-premises, in the cloud, or a combination of hybrid and multi-cloud architectures.

In the VMware Horizon hybrid deployment, infrastructure can run in an on-premises datacenter with the Horizon control plane running in the cloud as well as deploy on both on-premises and public cloud, and join the two. In addition, organizations can connect their existing Horizon 7 or Horizon 8 implementations to the Horizon Cloud Service using the Horizon Cloud Connector appliance.

The VMware Horizon Control Plane Services are designed to meet modern challenges for remote workers and connectivity. Organizations that use virtual desktops and apps from companies that only support cloud solutions can benefit from the Horizon Control Plane Services. Existing VDI implementations may only be able to work with cloud environments. The Horizon Control Plane allows managing all hybrid and multi-cloud deployments and configurations.

VMware Horizon hybrid architecture with the Horizon Control Plane


VMware Horizon hybrid architecture with the Horizon Control Plane

It provides many benefits outside of management, including:

  • Universal brokering
  • Image management
  • Application management
  • Monitoring
  • Lifecycle management
The Horizon Control Plane Services


The Horizon Control Plane Services

Just-in-time desktops and apps

VMware Horizon technology allows organizations to provision “just-in-time” desktops and applications. Using a technology VMware calls Instant Clone Technology, entire desktops can be provisioned just-in-time. The Instant Clone Technology allows the rapid cloning of virtual machines in just a few seconds! Instant clones can configure, on average, one clone per second.

The Instant Clone Technology is really a radical evolution of what VMware Composer clones could do previously. With Instant Clone Technology, the steps required to provision a clone with VMware Composer are dramatically reduced. Note the comparison of the two processes below:

Comparing VMware Horizon Composer with Instant Clone Technology


Comparing VMware Horizon Composer with Instant Clone Technology

The VMware Instant Clone Technology was born from a project called “vmFork” that uses rapid in-memory cloning of a running parent virtual machine and copy-on-write to deploy the virtual machines to production rapidly.

  • Copy-on-write – The copy-on-write technology is an optimization strategy that forces tasks first to create a separate private copy of the data to prevent its changes from becoming visible to all other tasks. With copy-on-write, the parent VM is quiesced and then forked. The forking process creates two branches or variations of development, and the resulting clones receive unique MAC addresses, UUIDs, and other unique information.

Using the Instant Clone Technology with VDI provisioning is perfect for the just-in-time desktop and applications use case. New workstations can quickly be provisioned, just in time for the user to log into the environment. Then, using VMware App Volumes to attach AppStacks to the just-in-time desktops dynamically, you can have fully functional workstations with dynamically assigned applications in a matter of seconds, fully customized for each user.

Should you be using VMware Horizon?

VMware Horizon is a powerful remote connectivity solution that allows businesses today to solve the challenges of remote workers and connectivity needs. In addition, it enables businesses to scale their deployments with modern architectures, including hybrid cloud deployments and multi-cloud architectures.

With the new VMware Horizon Control Plane services, organizations can manage multiple VMware Horizon deployments across sites, clouds, and different infrastructures from the cloud. In addition, it opens up the possibility for organizations to use heterogeneous implementations of virtual desktops that may exist across on-premises and public cloud environments and aggregate these services for end-users.

VMware provides a rich set of additional solutions and services that seamlessly integrate with VMware Horizon and extend the solution’s capabilities, scalability, security, and management. These include VMware vSAN, VMware NSX-T Data Center, VMware Workspace ONE, Workspace ONE UEM, and VMware Anywhere Workspace.

For end-user clients, connecting to Workspace ONE or native VMware Horizon resources is as simple as browsing the solution’s service URLs. While the VMware Horizon Client provides the most robust connectivity experience for end-user clients, users can also use the HTML client to connect to virtual machines, physical desktops, and applications using a simple web browser.

The Instant Clone Technology provided by VMware Horizon allows just-in-time desktops and applications to be provisioned in seconds, a feat that is amazing to see and provides businesses with the capability to have exponentially more scale in providing virtual desktops to end-users. In addition, the dynamic capabilities offered by VMware Horizon allow companies to elastically scale up and scale down virtual desktops, even with on-premises infrastructure.

Source :
https://www.altaro.com/vmware/vmware-horizon/

2021 VMware Major Developments, Releases, Updates & More!

Following a year that the world will remember for a long time to come (and mostly not for good reasons), we wrap up 2021 with a plethora of events happening in the tech industry. In the meantime, we certainly hope that you are doing well and staying safe during this upcoming festive period. In this article, we’ll recap the most important VMware news stories of the year and have a look ahead at what 2022 has in store. Let’s get going!

Company Growth

A lot has been going on this year in the VMware space, not only in a technical aspect but also with major changes within the company’s structure and management.

Financially, the company keeps doing very well with projected revenue of over $12.8 billion, an increase of around 9% compared to last year with expected significant growth in the SaaS area.

One of the axes VMware is also working on to generate revenue is the partner incentives program based on the customer life cycle. The new incentives reward partners that deliver PoCs, customers’ assessments and “sell-through” partners working together.

Acquisitions

VMware acquired a dizzying number of companies over the course of the previous year (2020). However, mergers are time-consuming and are never straightforward when it comes to restructuring teams, merging products into existing portfolios… VMware has put a lot of resources into integrating previous years’ acquisitions into their existing portfolios such as Carbon Black, Salt or Datrium.

This might be the reason why they only acquired one company in 2021 with Mesh7. Let’s have a closer look at what it is.

Mesh7

VMware acquired Mesh7 at the end of the first quarter of 2021. Their technology helps customers improve application resiliency, reliability and reduce blind spots through the integration of deep Layer 7 insights with cloud, host, and reputation data. They offer a distributed API Security Mesh solution (API Firewall and API Gateway) which is focused on securing the application layer at its core in Kubernetes environments.

VMware acquire Mesh7 at the end of March 2021 to further secure Tanzu Service Mesh

VMware acquired Mesh7 at the end of March 2021 to further secure Tanzu Service Mesh

VMware uses Envoy as an open-source Layer 7 proxy in Tanzu Service Mesh and Mesh7’s API gateway is being integrated into the solution to further secure the Kubernetes connectivity solution.

VMworld 2021

As usual, let’s quickly recap what happened during VMworld 2021 which was, once again, a virtual event. We will only skim over the surface of what was announced as a lot of other areas were covered such as Security, Networking, End-User services… For more information about the announcements made during this event, head over to our dedicated VMworld 2021 Round-up Article.

Strong focus on multi-cloud

VMware followed the trend set in the previous year with a strong push towards multi-cloud and managed cloud services. VMware Cross-Cloud services will offer a bunch of multi-cloud services you can pick and choose from in a flexible manner to facilitate and accelerate customers’ adoption.

VMware Cross-Cloud services aims at simplifying the shift to a multi-cloud SDDC

“VMware Cross-Cloud services aims at simplifying the shift to a multi-cloud SDDC”

VMware Sovereign Cloud tackles the issues around how sensitive data is dealt with through partnerships with Cloud providers. The goal is to offer those public entities and large organizations a data sovereignty seal of approval in a multi-cloud world.

Other announcements in the Cloud space included VMware Cloud on AWS Outpost and improvements to the disaster recovery as a service (DRaaS) offering.

Tanzu gets ever closer to maturity

VMware Tanzu, the company’s implementation of Kubernetes is being built upon ever since the portfolio was announced at VMworld 2019. The big reveal of this year’s event was Tanzu Community Edition, a free and open-source release of the solution aimed at learners and users.

Other Tanzu related announcements included VMware Cloud with Tanzu Services, managed Tanzu Kubernetes Grid (TKG), Tanzu Mission Control Essentials and a free tier with Tanzu mission control Starter.

VMware Tanzu Community Edition is full featured but free and open-source

“VMware Tanzu Community Edition is full-featured but free and open-source”

Lots of projects in development

VMware always has a bunch of projects with codenames in the works that later become actual products when they reached maturity. Remember how Tanzu used to be known as Project Pacific. In 2021, the company revealed no less than 9 major projects in various areas such as Edge computing, AI/ML, Security, multi-cloud, tiered memory for vSphere, Kubernetes…

Again, you can find the details about these projects in our VMworld 2021 roundup.

Edge Computing

The other area that was largely covered was Edge computing with the announcement of VMware Edge Compute Stack, a purpose-built and integrated stack offering HCI and SDN for small-scale VM and container workloads to effectively extend your SDDC to the Edge.

VMware Edge compute Stack helps solve use cases for a wide variety of challenges

“VMware Edge compute Stack helps solve use cases for a wide variety of challenges”

While a lot of good things went their way, 2021 was an eventful year for VMware. Several big announcements were made that will change the face of the company and a few vSphere related crises the company’s TAMs had to navigate.

VMware and DellEMC Split

Probably the biggest announcement of the year was the split from DellEMC which was the majority stakeholder with 81% shares in the company. This separation comes 5 years after Dell acquired EMC in September of 2016 for a whopping $67 billion, EMC being VMware’s controlling stakeholder at the time. On November 1st 2021, VMware becomes a standalone company for the first time since EMC acquired it in 2004, albeit after paying $11.5 billion in dividends to the shareholders.

In a news article, VMware’s new CEO Raghu Raghuram (more on that later) officialized the split and kept emphasizing their multi-cloud strategy with the goal of becoming “the Switzerland of the cloud industry”:

“As a standalone company, we now have the flexibility to partner even more deeply with all cloud and on-premises infrastructure companies to create a better foundation that drives results for our customers. And the increased flexibility we will have to use equity to complete future acquisitions will help us remain competitive. “

VMware has a new CEO

A number of top officers over at VMware left the building and were replaced by new top profiles. Among those, we find the CEO of the company himself. Pat Gelsinger, who led VMware between 2012 and 2021 gave his notice in February to become Intel’s new CEO after spending 30 years as a top profile between 1979 and 2009 for the blue team, a very impressive resume if you ask me.

VMware replaced him with Raghu Raghuram, the previous COO who’d been climbing up the corporate ladder since 2003, clocking over 18 years of employment to reach the top of the pyramid.

Raghu Raghuram succeeds to Pat Gelsinger as VMware’s CEO

Raghu Raghuram succeeds to Pat Gelsinger as VMware’s CEO

vSphere 7 Update 3 removed

On a more technical note, 2021 was a rather turbulent year for vSphere 7.0. The year started with many customers encountering purple screens on vSphere hypervisors installed on SD cards or USB sticks, which eventually led VMware to pull support for these boot devices. This wasn’t received particularly well among the customer base as many were taken by surprise and now have to plan for it, which will be a large piece of work and investment depending on the size of the environment.

Following this shaky start, customers started having problems with vSphere 7 Update 3 causing PSOD in some instances. In order to fix it, VMware released patches that ended up breaking vSphere HA for many customers using a certain type of Intel adapters. VMware eventually decided to stop the haemorrhage by removing vSphere 7 Update 3 from distribution altogether, just over a month after its release.

vSphere 7 Update 3 was crippled with issues since its initial release

“vSphere 7 Update 3 was crippled with issues since its initial release”

Needless to say that customers were pretty unhappy with how this unfolded. Many blamed the 6 months release cycle and quality control being put to the side in favor of shiny new Cloud or Tanzu features. Let’s hope the scission from DellEMC will entice VMware to regain a certain level of quality control and that organizations won’t put the deployment of security patches on hold as a result.

VMware Cloud Universal

As you can tell, VMware is very keen to push Cloud subscriptions to its customers and VMware Cloud Universal, which was released in April 2021, was another testimony of that. A subscription offering that offers access to multi-cloud resources, be it infrastructure, compute, storage, networking, modern apps…

The idea is to be able to flexibly deploy VMware Cloud Infrastructure across private and public clouds. VMware Cloud Universal includes VCF-Subscription (also released in 2021), VMware Cloud on AWS and VMware Cloud on DellEMC.

Now, I’ll admit that it is getting a bit tricky to make sense of the many cloud offerings proposed by VMware with VMC, VMC on AWS, VMware Cloud Universal, VMware Cross-Cloud services and then the subtleties in each one of them.

VMware Cloud Universal allows customers to establish a flexible commercial agreement with VMware

“VMware Cloud Universal allows customers to establish a flexible commercial agreement with VMware to commit once and consume dynamically”

Ransomware Attacks Targeting vSphere ESXi

In 2021, we, unfortunately, witnessed no curb in the infamous growing trend of vSphere Ransomware attacks. While most encrypting ransomware attacks were historically focused on Windows and Linux instances, vSphere is now being targeted as well. Bad actors will try to gain access to the virtual infrastructure and initiate encryption of the datastores to claim a ransom, hence impacting every single VMs in the environment.

Fortunately, most companies are now investing large amounts of resources to mitigate the risks and protect the customers, for instance, Altaro has been doing it for a long time now.

A Look Ahead to 2022

I wrapped up last year’s roundup with “Watch for 2021 as it is without a doubt that it will be a year packed with major events”. Well, I think it is safe to say that it turned out to be true. VMware’s split from DellEMC will give the company absolute autonomy over its market strategy and path to a multi-cloud world. 2022 will see a maturing of these core cloud technologies alongside VMware doubling down on its acquisition strategy of key technologies that will solidify its commitment to this direction.

While we are eager to find out what it brings in terms of novelties, we are equally looking forward to a return to a more sensible release cycle and the distribution of a stable version of the historic hypervisor (well that’s my main hope at least!) I’d love to hear your thoughts, so feel free to take your bet in the comment section as to what 2022 will bring!

Source :
https://www.altaro.com/vmware/2021-vmware-developments/

DSA-2021-088: Dell Client Platform Security Update for an Insufficient Access Control Vulnerability in the Dell dbutil Driver

Dell has released remediation for a security vulnerability affecting the dbutil_2_3.sys driver packaged with Dell Client firmware update utility packages and other products.

Proprietary Code CVEDescriptionCVSS   Base ScoreCVSS Vector String
CVE-2021-21551Dell dbutil_2_3.sys driver contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. Local authenticated user access is required.8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The vulnerability described in the table above exists in the dbutil_2_3.sys driver. This driver may have been installed on to the Windows operating system of your Dell Client platform by one or more impacted products or components.

Refer to the “Affected Products and Remediation” section of this advisory for details regarding:

  • The list of impacted platforms, products, and components
  • The remediation steps including:
    • How to remove the vulnerable driver from your system
    • How to obtain an updated, remediated version of the driver 
  • What to know when using end of service life (aka end of support) platforms, products, or components

Additional, related information is available in this FAQ.

Dell Technologies raccomanda a tutti i clienti di prendere in considerazione sia il punteggio base CVSS, sia ogni eventuale punteggio temporale o ambientale che possa avere effetti sul livello di gravità potenziale associato a una specifica vulnerabilità di sicurezza.

Affected Products and Remediation

This section includes the following subsections:

  1. Affected platforms, products, and components.
  2. Remediation Steps:
    1. Determine impacted platforms, products, and components in your environment.
    2. Remove the vulnerable driver from your system.
    3. Obtain an updated, remediated version of the driver.
  3. What to know when installing a firmware update using an unremediated firmware update utility package.
  4. What to know when using end of service life (aka end of support) platforms, products, or components.

 
1. Affected platforms, products, and components
The vulnerable driver (dbutil_2_3.sys) may have been installed on to the Windows operating system of your Dell Client platform by one or more of the following products or components:

  • Impacted firmware update utility packages, including BIOS update utilities, Thunderbolt firmware update utilities, TPM firmware update utilities and dock firmware update utilities (see Note 1 and Note 2 below).
  • Any of the Dell Download Notification solutions, including Dell Command Update, Dell Update, Alienware Update, and Dell SupportAssist for PCs (Home and Business).
  • Dell System Inventory Agent
  • Dell Platform Tags
  • Dell BIOS Flash Utility

Note 1: The specific Dell Client platforms with impacted firmware update utility packages, including BIOS update utilities, Thunderbolt firmware update utilities, TPM firmware update utilities and dock firmware update utilities, are listed in the “Additional Information” section of this advisory.

  • This information is split into two tables with Table A listing impacted, supported platforms and Table B listing impacted platforms which have reached end of service life (aka end of support).

Note 2: This vulnerability is in the dbutil_2_3.sys driver which is included with firmware update utility packages. The actual firmware is not impacted by the vulnerability.

 
 
2. Remediation Steps
 Execute the following three steps to remediate this vulnerability:

  • 2.1. Determine impacted platforms, products, and components in your environment.
  • 2.2. Remove the vulnerable driver from your system.
  • 2.3. Obtain an updated, remediated version of the driver .

Details on each step are provided below.  

2.1 Determine impacted platforms, products, and components in your environment

Answer the following questions to determine the impacted platforms, products, and components in your environment. Then, execute the defined actions to remediate your environment.

2.1.1 Are you using a Dell Client platform which has an impacted firmware update utility package?

 If yes, perform the following actions:

  • Action 1: Remove the dbutil_2_3.sys driver from your system as described in 2.2.2.
  • Action 2: Obtain an updated, remediated version of the driver described in 2.3.  

Note: The specific Dell Client platforms with impacted firmware update utility packages, including BIOS update utilities, Thunderbolt firmware update utilities, TPM firmware update utilities and dock firmware update utilities, are listed in the “Additional Information” section of this advisory.

  • This information is split into two tables with Table A listing impacted, supported platforms and Table B listing impacted platform which have reached end of service life (aka end of support).

2.1.2 Are you using:

  • Any of the Dell Download Notification solutions including, Dell Command Update, Dell Update, Alienware Update, and Dell SupportAssist for PCs (Home and Business)?
  • Dell System Inventory Agent
  • Dell Platform Tags
  • Dell BIOS Flash Utility

If yes, perform the following actions:

  • Action 1: Update to a remediated version of the product or component as described in 2.2.1.
  • Action 2: Remove the dbutil_2_3.sys driver from your system as described in 2.2.2.

2.2. Remove the vulnerable driver from your system

Execute the following 2 steps to remove the dbutil_2_3.sys driver from your system, as applicable.

2.2.1 Update to a remediated version of the impacted product or component

If you are using any of the following products or components:

  • Any of the Dell Download Notification solutions including, Dell Command Update, Dell Update, Alienware Update, and Dell SupportAssist for PCs (Home and Business)
  • Dell System Inventory Agent
  • Dell Platform Tags
  • Dell BIOS Flash Utility

You must first update to a remediated version of the impacted product or component using respective instructions below. This action will also install an updated remediated version of the driver (DBUtilDrv2.sys).

For Dell Command Update, Dell Update, and Alienware Update:

  • Manually update to version 4.2 or greater
    • Visit the Dell Support Drivers and Download site for updates for your platform
      OR
    • If the self-update feature of these components is not enabled on your system, you can:
      • On an internet connected system, open / run the application
      • Click “Check for Updates”.

Note: When using either the “Check for Updates” option above, or when the self-update feature for these components is enabled, components will be updated as needed to prepare for driver removal via the next step (2.2.2), but the version of the component may not be reflected as an updated version.

  • Reboot your system.

For Dell SupportAssist for PCs (Home and Business):

  • Manually update to the latest available version:
    • Dell SupportAssist for Home PCs version 3.9.2 or greater will include the remediated driver and is expected to be available by June 15, 2021.
    • Dell SupportAssist for Business PCs version 2.4.1 or greater will include the remediated driver.
      OR
    • If the self-update feature of these components is not enabled on your system, you can:
      • On an internet connected system, open / run the application
      • Click “Check for Updates”.

Note: When using either the “Check for Updates” option above, or when the self-update feature for these components is enabled, components will be updated as needed to prepare for driver removal via the next step (2.2.2), but the version of the component may not be reflected as an updated version.

  • Reboot your system.

 For Dell System Inventory Agent:

  • Synchronize your Microsoft System Center Configuration Manager’s third-party updates feature, or Microsoft System Center Update Publisher (along with Windows Server Updates Services) to the latest Dell-provided catalog. Doing so will update the systems in your enterprise environment with the updated, remediated Dell System (OpenManage) Inventory Agent.
    OR
  • Update to version 2.7.0.2 or greater by downloading / applying the latest available update on this page .
  • Reboot your system.

For Dell Platform Tags:

  • Update to version 4.0.20.0, A04 or greater by downloading / applying the latest available update on this page.
  • Reboot your system.

For Dell BIOS Flash Utility:

  • Update to version 3.3.11, A07 or greater by downloading / applying the latest available update on this page.
  • Reboot your system.

2.2.2 Remove the dbutil_2_3.sys driver from your system

Remove the dbutil_2_3.sys driver from your system using one of the following options:

  • Manually download and run a utility to remove the driver from the system (Option A).
  • Utilize one of the Dell Download Notification solutions to automatically obtain and run a utility to remove the driver from the system (Option B).
  • Manually remove the driver from the system (Option C).

Option A (Recommended):
Manually download and run the Dell Security Advisory Update – DSA-2021-088 utility to remove the dbutil_2_3.sys driver from the system.

Option B:
Use one of the Dell Download Notification solutions, to obtain and run the Dell Security Advisory Update – DSA-2021-088 utility to remove the dbutil_2_3.sys driver from the system.

Scenario 1: If your Dell Download Notification solution is configured to both automatically notify you of updates and apply them, then this utility will be automatically downloaded and run for you.

Scenario 2: If your Dell Download Notification solution is not configured to automatically download and apply updates, obtain and run the utility as follows:

Option C:
Manually remove the vulnerable dbutil_2_3.sys driver from the system using the following steps:

1. Check the following locations for the dbutil_2_3.sys driver file:

  • C:\Users\<username>\AppData\Local\Temp
  • C:\Windows\Temp

2. Select the dbutil_2_3.sys file and hold down the SHIFT key while pressing the DELETE key to permanently delete.

3. From an administrator command prompt, run “sc.exe delete DBUtil_2_3”.

Reference: For information on sc.exe commands, see Microsoft documentation.

2.3 Obtain an updated, remediated version of the driver
Execute the following to obtain an updated driver (DBUtilDrv2.sys) on your system.

Reminder: The updated driver was previously installed for certain products and components as a part of the instructions in Section 2.2.1.

For a Dell Client platform which has an impacted firmware update utility package:

  • With your next scheduled firmware update, download and apply the latest available firmware update utility which contains a remediated dbutil driver (DBUtilDrv2.sys). Customers can use one of the Dell Download Notification solutions to receive updated firmware update utility packages, as applicable.
  • Reboot your system

Notes:

  • For supported platforms running Windows 10, updates are available as of the publishing of this advisory. (See Table A)
  • For supported platforms running Windows 7 or 8.1, updates are expected to be available by July 31, 2021. Once the updates are available, this advisory will be updated. If you update your BIOS, Thunderbolt firmware, TPM firmware, or doc firmware prior to the updates being available, you must also execute one of the three options defined in Step 2.2.2 of this section – even if you have previously performed this step – immediately following the update.

 
3. What to know when installing a firmware update using an unremediated firmware update utility package
You should still execute the steps in Sections 2.1 and 2.2 now. However, if you later update your BIOS, Thunderbolt firmware, TPM firmware, or dock firmware, to a version prior to the versions listed in Table A, you must take the following actions after applying the firmware update:

  1. Reboot your system.
  2. Repeat step 2.2.2 to again remove the dbutil_2_3.sys driver from your system.


4. What to know when using end of service life (aka end of support) platforms, products, or components
Remediated packages will not be provided for end of service life platforms (see Table B). Therefore, you must:

  1. Execute the steps in Sections 2.1 and 2.2.
  2. After applying any firmware update, including BIOS, Thunderbolt firmware, TPM firmware, or dock firmware:
  • Reboot your system.
  • Repeat step 2.2.2 to again remove the dbutil_2_3.sys driver from your system.
Ringraziamenti

Dell would like to thank Alex Ionescu, Satoshi Tanda, and Yarden Shafir of CrowdStrike; Enrique Nissim of IOActive; Scott Noone of OSR; and Kasif Dekel of SentinelOne for reporting this issue.
 

Cronologia delle revisioni
RevisionDateDescription
1.02021-05-04Initial Release
1.12021-05-11Updated links to Dell Security Advisory Update – DSA-2021-088 utility v2.1 (A02)
2.02021-05-25Added additional impacted software products Dell BIOS Flash Utility and Dell SupportAssist for PCs (Home and Business)
Informazioni correlate

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Informazioni aggiuntive

Additional, related information is available in this FAQ.

Table A: Supported Dell platforms impacted firmware update utility packages, including BIOS update utilities, Thunderbolt firmware update utilities, TPM firmware update utilities and dock firmware update utilities.

Note: For platforms running Windows 10: Obtain the version specified in the table, or greater as available, for your BIOS, Thunderbolt Firmware Update, TPM Firmware Update, Dock Firmware Update Version. Once available, the table will be revised to add the updated versions for Windows 7 and 8.1.

Platform/ProductBIOS Version (or greater)Thunderbolt Firmware Update Version (or greater)TPM Firmware Update Version (or greater)Dock Firmware Update Version (or greater)
ChengMing 39671.11.0N/AN/AN/A
ChengMing 39771.11.0N/AN/AN/A
ChengMing 39802.17.0N/AN/AN/A
ChengMing 39881.5.0N/AN/AN/A
ChengMing 39901.3.1N/AN/AN/A
ChengMing 39911.3.1N/AN/AN/A
Dell G15 55101.3.1N/AN/AN/A
Dell G3 35001.7.1N/AN/AN/A
Dell G3 35791.14.04.46.154.001, A03N/AN/A
Dell G3 37791.14.04.46.154.001, A03N/AN/A
Dell G5 50001.1.0N/AN/AN/A
Dell G5 50901.4.0N/AN/AN/A
Dell G5 55001.7.1N/AN/AN/A
Dell G5 55871.15.04.46.152.001, A02N/AN/A
Dell G5 55901.14.0N/AN/AN/A
Dell G7 75001.6.0N/AN/AN/A
Dell G7 75881.15.04.46.152.001, A02N/AN/A
Dell G7 75901.14.0N/AN/AN/A
Dell G7 77001.6.0N/AN/AN/A
Dell G7 77901.14.0N/AN/AN/A
Dell Gaming G3 35901.12.0N/AN/AN/A
Dell Precision 3430 Tower1.10.0N/A7.2.0.2N/A
Dell Precision 3430 XL1.10.0N/A7.2.0.2N/A
Dell Precision 3431 Tower1.7.2N/AN/AN/A
Dell Precision 3630 Tower2.7.0N/AN/AN/A
Dell Precision 3930 Rack2.10.0N/A7.2.0.2N/A
Dell Precision 3930 XL Rack2.10.0N/A7.2.0.2N/A
Dell Precision 5820 Tower2.8.0N/A7.2.0.2N/A
Dell Precision 7820 Tower2.12.0N/AN/AN/A
Dell Precision 7820 XL Tower2.12.0N/AN/AN/A
Dell Precision 7920 Tower2.12.0N/AN/AN/A
Dell Precision 7920 XL Tower2.12.0N/AN/AN/A
Embedded Box PC 50001.9.1N/AN/AN/A
Inspiron 13 53701.17.0N/AN/AN/A
Inspiron 14 (5468)1.13.1N/AN/AN/A
Inspiron 14 (7460)1.14.1N/AN/AN/A
Inspiron 14 Gaming (7466)1.8.0N/AN/AN/A
Inspiron 14 Gaming (7467)1.13.1N/AN/AN/A
Inspiron 15 (5566)1.13.1N/AN/AN/A
Inspiron 15 (5567)1.4.1N/AN/AN/A
Inspiron 15 (7560)1.14.1N/AN/AN/A
Inspiron 15 (7572)1.6.1N/AN/AN/A
Inspiron 15 5582 2-in-12.9.0N/AN/AN/A
Inspiron 15 Gaming (7566)1.8.0N/AN/AN/A
Inspiron 15 Gaming (7567)1.13.1N/AN/AN/A
Inspiron 15 Gaming (7577)1.12.14.46.150.001, A05N/AN/A
Inspiron 17 (5767)1.4.1N/AN/AN/A
Inspiron 32681.15.0N/AN/AN/A
Inspiron 34702.17.0N/AN/AN/A
Inspiron 34711.5.0N/AN/AN/A
Inspiron 34801.12.0N/AN/AN/A
Inspiron 34811.11.0N/AN/AN/A
Inspiron 34901.10.0N/AN/AN/A
Inspiron 34931.12.0N/AN/AN/A
Inspiron 35011.4.0N/AN/AN/A
Inspiron 35801.12.0N/AN/AN/A
Inspiron 35811.11.0N/AN/AN/A
Inspiron 35831.12.0N/AN/AN/A
Inspiron 35841.11.0N/AN/AN/A
Inspiron 35901.10.0N/AN/AN/A
Inspiron 35931.12.0N/AN/AN/A
Inspiron 36681.15.0N/AN/AN/A
Inspiron 36702.17.0N/AN/AN/A
Inspiron 36711.5.0N/AN/AN/A
Inspiron 37801.12.0N/AN/AN/A
Inspiron 37811.11.0N/AN/AN/A
Inspiron 37901.10.0N/AN/AN/A
Inspiron 37931.12.0N/AN/AN/A
Inspiron 38801.3.1N/AN/AN/A
Inspiron 38811.3.1N/AN/AN/A
Inspiron 38911.0.2N/AN/AN/A
Inspiron 53001.5.0N/AN/AN/A
Inspiron 53011.6.1N/AN/AN/A
Inspiron 53901.10.0N/AN/AN/A
Inspiron 53911.11.0N/AN/AN/A
Inspiron 5400 2-in-11.5.0N/AN/AN/A
Inspiron 5400 AIO1.3.1N/AN/AN/A
Inspiron 54011.5.1N/AN/AN/A
Inspiron 54021.4.1N/AN/AN/A
Inspiron 5406 2-in-11.4.1N/AN/AN/A
Inspiron 54081.5.1N/AN/AN/A
Inspiron 54091.4.1N/AN/AN/A
Inspiron 54802.9.0N/AN/AN/A
Inspiron 5481 2-in-12.9.0N/AN/AN/A
Inspiron 54822.9.0N/AN/AN/A
Inspiron 54901.12.0N/AN/AN/A
Inspiron 5490 AIO1.7.0N/AN/AN/A
Inspiron 5491 2-in-11.8.1N/AN/AN/A
Inspiron 54931.12.0N/AN/AN/A
Inspiron 54941.10.0N/AN/AN/A
Inspiron 54981.12.0N/AN/AN/A
Inspiron 55011.5.1N/AN/AN/A
Inspiron 55021.4.1N/AN/AN/A
Inspiron 55081.5.1N/AN/AN/A
Inspiron 55091.4.1N/AN/AN/A
Inspiron 55701.4.1N/AN/AN/A
Inspiron 55802.9.0N/AN/AN/A
Inspiron 55831.12.0N/AN/AN/A
Inspiron 55841.12.0N/AN/AN/A
Inspiron 55901.12.0N/AN/AN/A
Inspiron 5591 2-in-11.8.1N/AN/AN/A
Inspiron 55931.12.0N/AN/AN/A
Inspiron 55941.10.0N/AN/AN/A
Inspiron 55981.12.0N/AN/AN/A
Inspiron 57701.4.1N/AN/AN/A
Inspiron 73001.6.1N/AN/AN/A
Inspiron 7300 2-in-11.2.4N/AN/AN/A
Inspiron 7306 2-in-11.4.1N/AN/AN/A
Inspiron 73801.12.0N/AN/AN/A
Inspiron 73861.9.0N/AN/AN/A
Inspiron 73901.11.0N/AN/AN/A
Inspiron 73911.11.0N/AN/AN/A
Inspiron 7391 2-in-11.9.14.61.136.013, A01N/AN/A
Inspiron 74001.6.1N/AN/AN/A
Inspiron 74721.6.1N/AN/AN/A
Inspiron 74901.6.04.60.111.017, A03N/AN/A
Inspiron 75001.5.14.61.124.009, A01N/AN/A
Inspiron 7500 2-in-1 Black1.2.4N/AN/AN/A
Inspiron 7500 2-in-1 Silver1.5.0N/AN/AN/A
Inspiron 75011.5.14.61.124.009, A01N/AN/A
Inspiron 7506 2-in-11.4.1N/AN/AN/A
Inspiron 75801.12.0N/AN/AN/A
Inspiron 75861.9.0N/AN/AN/A
Inspiron 75901.8.0N/AN/AN/A
Inspiron 7590 2-in-11.11.0N/AN/AN/A
Inspiron 75911.8.0N/AN/AN/A
Inspiron 7591 2-in-11.9.14.61.136.013, A01N/AN/A
Inspiron 77001.3.1N/AN/AN/A
Inspiron 7706 2-in-11.4.1N/AN/AN/A
Inspiron 77861.9.0N/AN/AN/A
Inspiron 77901.7.0N/AN/AN/A
Inspiron 77911.9.14.61.136.013, A01N/AN/A
Inspiron 5491 AIO1.7.0N/AN/AN/A
Latitude 12 72851.9.24.46.146.001, A05N/AN/A
Latitude 12 Rugged Extreme 72141.28.0N/AN/AN/A
Latitude 12 Rugged Tablet 72121.31.2N/AN/AN/A
Latitude 14 Rugged 54141.28.0N/AN/AN/A
Latitude 14 Rugged Extreme 74141.28.0N/AN/AN/A
Latitude 31201.0.5N/AN/AN/A
Latitude 31801.13.2N/AN/AN/A
Latitude 31891.13.2N/AN/AN/A
Latitude 31901.13.1N/AN/AN/A
Latitude 3190 2-in-11.13.1N/AN/AN/A
Latitude 33001.10.1N/AN/AN/A
Latitude 33011.13.0N/AN/AN/A
Latitude 33101.8.3N/AN/AN/A
Latitude 3310 2-in-11.17.1N/AN/AN/A
Latitude 33801.13.1N/AN/AN/A
Latitude 33901.14.2N/AN/AN/A
Latitude 34001.16.0N/A74.64N/A
Latitude 34101.5.1N/AN/AN/A
Latitude 34701.19.0N/AN/AN/A
Latitude 34801.15.1N/AN/AN/A
Latitude 3480 mobile thin client1.15.1N/AN/AN/A
Latitude 34901.14.1N/A7.2.0.2N/A
Latitude 35001.16.0N/A74.64N/A
Latitude 35101.5.1N/AN/AN/A
Latitude 35701.19.0N/AN/AN/A
Latitude 35801.15.1N/AN/AN/A
Latitude 35901.14.1N/A7.2.0.2N/A
Latitude 51751.8.1N/AN/AN/A
Latitude 51791.8.1N/AN/AN/A
Latitude 52001.14.04.46.134.002, A04N/AN/A
Latitude 52801.19.3N/AN/AN/A
Latitude 5280 mobile thin client1.19.3N/AN/AN/A
Latitude 5285 2-in-11.11.2N/AN/AN/A
Latitude 52881.19.3N/AN/AN/A
Latitude 52891.22.2N/AN/AN/A
Latitude 52901.16.3N/A7.2.0.2N/A
Latitude 5290 2-in-11.13.14.46.147.001, A037.2.0.2N/A
Latitude 53001.14.0N/A74.64N/A
Latitude 5300 2-IN-11.14.04.46.134.002, A0474.64N/A
Latitude 53101.5.24.61.131.007, A00N/AN/A
Latitude 5310 2-in-11.5.24.61.131.007, A00N/AN/A
Latitude 53201.14.0N/AN/AN/A
Latitude 5320 2-in-11.14.0N/AN/AN/A
Latitude 54001.10.14.46.135.003, A0474.64N/A
Latitude 54011.11.14.46.135.003, A0474.64N/A
Latitude 54101.5.14.60.142.001, A01N/AN/A
Latitude 54111.4.34.60.119.008, A01N/AN/A
Latitude 54201.5.2N/AN/AN/A
Latitude 54801.19.34.46.155.001, A06N/AN/A
Latitude 54881.19.34.46.155.001, A06N/AN/A
Latitude 54901.16.3N/A7.2.0.2N/A
Latitude 54911.14.14.46.107.019, A047.2.0.2N/A
Latitude 54951.4.0N/AN/AN/A
Latitude 55001.10.14.46.135.003, A0474.64N/A
Latitude 55011.11.14.46.135.003, A0474.64N/A
Latitude 55101.5.14.60.142.001, A01N/AN/A
Latitude 55111.4.34.60.119.008, A01N/AN/A
Latitude 55201.5.1N/AN/AN/A
Latitude 55801.19.34.46.155.001, A06N/AN/A
Latitude 55901.16.3N/A7.2.0.2N/A
Latitude 55911.14.14.46.107.019, A047.2.0.2N/A
Latitude 7200 2-in-11.10.14.46.114.005, A0374.64N/A
Latitude 7210 2 in 11.5.14.60.130.010, A01N/AN/A
Latitude 72751.9.04.26.10.001, A08N/AN/A
Latitude 72801.20.24.46.155.001, A06N/AN/A
Latitude 72901.18.04.46.107.019, A047.2.0.2N/A
Latitude 73001.12.04.46.135.003, A0474.64N/A
Latitude 73101.5.14.60.142.001, A01N/AN/A
Latitude 73201.5.0N/AN/AN/A
Latitude 73701.22.34.26.10.001, A08N/AN/A
Latitude 73801.20.24.46.155.001, A06N/AN/A
Latitude 73891.22.2N/AN/AN/A
Latitude 73901.18.04.46.107.019, A047.2.0.2N/A
Latitude 7390 2-in-11.17.04.46.107.019, A047.2.0.2N/A
Latitude 74001.12.04.46.135.003, A0474.64N/A
Latitude 7400 2in11.10.04.46.112.010, A0374.64N/A
Latitude 74101.5.14.60.142.001, A01N/AN/A
Latitude 74201.5.0N/AN/AN/A
Latitude 74801.20.24.46.155.001, A06N/AN/A
Latitude 74901.18.04.46.107.019, A047.2.0.2N/A
Latitude 75201.5.0N/AN/AN/A
Latitude 94101.5.14.60.142.001, A01N/AN/A
Latitude 95101.4.24.60.116.012, A01N/AN/A
Latitude E52701.24.3N/AN/AN/A
Latitude E54701.24.3N/AN/AN/A
Latitude E55701.24.34.26.10.001, A08N/AN/A
Latitude E72701.27.3N/AN/AN/A
Latitude E7270 mobile thin client1.20.3,N/AN/AN/A
Latitude E74701.27.3N/AN/AN/A
Latitude Rugged 54201.12.0N/A7.2.0.2N/A
Latitude Rugged 54241.12.0N/A7.2.0.2N/A
Latitude Rugged 74241.12.0N/A7.2.0.2N/A
Latitude Rugged Extreme 74241.12.0N/AN/AN/A
Latitude Rugged Extreme Tablet 72201.9.1N/A74.64N/A
Latitude Rugged Extreme Tablet 7220EX1.9.1N/A74.64N/A
OptiPlex 30401.14.2N/AN/AN/A
OptiPlex 30461.11.1N/AN/AN/A
OptiPlex 30501.15.1N/AN/AN/A
OptiPlex 3050 AIO1.16.1N/AN/AN/A
OptiPlex 30601.9.1N/A7.2.0.2N/A
OPTIPLEX 30701.7.0N/AN/AN/A
OptiPlex 30801.3.1N/AN/AN/A
OptiPlex 3090 Ultra1.0.10N/AN/AN/A
OptiPlex 3240 All-in-One1.11.1N/AN/AN/A
OPTIPLEX 3280 AIO1.3.1N/AN/AN/A
OptiPlex 50401.17.1N/AN/AN/A
OptiPlex 50501.15.1N/AN/AN/A
OptiPlex 5055 A-Serial1.2.9N/AN/AN/A
OptiPlex 5055 Ryzen APU1.2.8N/AN/AN/A
OptiPlex 5055 Ryzen CPU1.1.20N/AN/AN/A
OptiPlex 50601.9.1N/A7.2.0.2N/A
OptiPlex 50701.7.0N/AN/AN/A
OptiPlex 50801.3.10N/AN/AN/A
OptiPlex 5250 All-in-One1.16.1N/AN/AN/A
OptiPlex 5260 All-In-One1.12.0N/A7.2.0.2N/A
OptiPlex 5270 AIO1.7.0N/AN/AN/A
OptiPlex 5480 AIO1.4.0N/AN/AN/A
OptiPlex 70401.19.0N/AN/AN/A
OptiPlex 70501.15.1N/AN/AN/A
OptiPlex 70601.9.1N/A7.2.0.2N/A
OptiPlex 70701.7.2N/AN/AN/A
OptiPlex 7070 Ultra1.7.0N/AN/AN/A
OptiPlex 70711.7.2N/AN/AN/A
OptiPlex 70801.13.0N/AN/AN/A
OptiPlex 7090 Ultra1.0.10N/AN/AN/A
OptiPlex 7440 AIO1.14.1N/AN/AN/A
OptiPlex 7450 All-In-One1.16.1N/AN/AN/A
OptiPlex 7460 All-In-One1.12.0N/A7.2.0.2N/A
OPTIPLEX 7470 AIO1.7.0N/AN/AN/A
OPTIPLEX 7480 AIO1.6.2N/AN/AN/A
OptiPlex 7760 AIO1.12.0N/A7.2.0.2N/A
OPTIPLEX 7770 AIO1.7.0N/AN/AN/A
OPTIPLEX 7780 AIO1.6.2N/AN/AN/A
OptiPlex XE31.9.1N/A7.2.0.2N/A
Precision 17 M57501.7.2N/AN/AN/A
Precision 3240 CFF1.4.0N/AN/AN/A
Precision 3420 Tower2.17.1N/AN/AN/A
Precision 34401.13.0N/AN/AN/A
Precision 35101.24.34.26.10.001, A08N/AN/A
Precision 35201.19.34.46.155.001, A06N/AN/A
Precision 35301.14.14.46.107.019, A047.2.0.2N/A
Precision 35401.10.14.46.135.003, A0474.64N/A
Precision 35411.11.14.46.135.003, A0474.64N/A
Precision 35501.5.14.60.142.001, A01N/AN/A
Precision 35511.4.34.60.119.008, A01N/AN/A
Precision 35601.5.1N/AN/AN/A
Precision 3620 Tower2.17.1N/AN/AN/A
Precision 36401.4.3N/AN/AN/A
Precision 55101.16.14.26.11.001, A09N/AN/A
Precision 55201.22.14.26.12.001, A04N/AN/A
Precision 55301.18.14.46.152.001, A027.2.0.2N/A
Precision 5530 2-in-11.12.94.46.145.001, A027.2.0.2N/A
Precision 55401.9.14.46.110.002, A027.2.0.2N/A
Precision 55501.7.14.60.117.022, A00N/AN/A
Precision 5720 AIO2.8.1N/AN/AN/A
Precision 5820 XL Tower2.8.0N/AN/AN/A
Precision 75201.19.24.46.155.001, A06N/AN/A
Precision 75301.15.34.62.102.019, A027.2.0.2N/A
Precision 75401.11.24.62.108.013, A03N/AN/A
Precision 75501.6.24.62.120.007, A01N/AN/A
Precision 77201.19.24.46.155.001, A06N/AN/A
Precision 77301.15.34.62.102.019, A027.2.0.2N/A
Precision 77401.11.24.62.108.013, A03N/AN/A
Precision 77501.6.24.62.120.007, A01N/AN/A
Vostro 13 53701.17.0N/AN/AN/A
Vostro 14 (5468)1.14.1N/AN/AN/A
Vostro 14 54711.17.0N/AN/AN/A
Vostro 15 (5568)1.14.1N/AN/AN/A
Vostro 15 75701.12.14.46.151.001, A05N/AN/A
Vostro 15 7580 G-Series1.15.04.46.153.001, A02N/AN/A
Vostro 30702.17.0N/AN/AN/A
Vostro 32671.15.1N/AN/AN/A
Vostro 32681.15.1N/AN/AN/A
Vostro 34001.4.0N/AN/AN/A
Vostro 34011.1.0N/AN/AN/A
Vostro 34702.17.0N/AN/AN/A
Vostro 34711.5.0N/AN/AN/A
Vostro 34801.12.0N/AN/AN/A
Vostro 34811.11.0N/AN/AN/A
Vostro 34901.10.0N/AN/AN/A
Vostro 34911.15.0N/AN/AN/A
Vostro 35001.4.0N/AN/AN/A
Vostro 35011.1.0N/AN/AN/A
Vostro 35801.12.0N/AN/AN/A
Vostro 35811.11.0N/AN/AN/A
Vostro 35831.12.0N/AN/AN/A
Vostro 35841.11.0N/AN/AN/A
Vostro 35901.10.0N/AN/AN/A
Vostro 35911.15.0N/AN/AN/A
Vostro 36601.15.1N/AN/AN/A
Vostro 36671.15.1N/AN/AN/A
Vostro 36681.15.1N/AN/AN/A
Vostro 36691.15.1N/AN/AN/A
Vostro 36702.17.0N/AN/AN/A
Vostro 36711.5.0N/AN/AN/A
Vostro 3681 1.3.1N/AN/AN/A
Vostro 36901.0.2N/AN/AN/A
Vostro 38811.3.1N/AN/AN/A
Vostro 38881.3.1N/AN/AN/A
Vostro 38901.0.2N/AN/AN/A
Vostro 50901.5.0N/AN/AN/A
Vostro 53001.5.0N/AN/AN/A
Vostro 53011.6.1N/AN/AN/A
Vostro 53901.10.0N/AN/AN/A
Vostro 53911.11.0N/AN/AN/A
Vostro 54011.5.3N/AN/AN/A
Vostro 54021.4.1N/AN/AN/A
Vostro 54101.5.1N/AN/AN/A
Vostro 54812.9.0N/AN/AN/A
Vostro 54901.12.0N/AN/AN/A
Vostro 54911.12.0N/AN/AN/A
Vostro 55011.5.1N/AN/AN/A
Vostro 55021.4.1N/AN/AN/A
Vostro 55812.9.0N/AN/AN/A
Vostro 55901.12.0N/AN/AN/A
Vostro 55911.12.0N/AN/AN/A
Vostro 58801.3.0N/AN/AN/A
Vostro 58901.0.2N/AN/AN/A
Vostro 75001.5.14.61.124.009, A01N/AN/A
Vostro 75901.8.0N/AN/AN/A
Wyse 50701.9.0N/A7.2.0.2N/A
Wyse 54701.6.0N/AN/AN/A
Wyse 5470 All-In-One1.7.0N/AN/AN/A
Wyse 7040 Thin Client1.10.1N/AN/AN/A
XPS 12 (9250)1.9.04.26.10.001, A08N/AN/A
XPS 13 (9360)2.15.04.26.13.001, A04N/AN/A
XPS 13 (9370)1.14.34.46.149.001, A047.2.0.2N/A
XPS 13 2-in-1 (9365)2.15.04.46.148.001, A03N/AN/A
XPS 13 73901.7.04.46.106.027, A01N/AN/A
XPS 13 7390 2-in-11.7.1N/A74.64N/A
XPS 13 93001.4.1N/A74.64N/A
XPS 13 93051.0.5N/AN/AN/A
XPS 13 93102.2.0N/AN/AN/A
XPS 13 9310 2-in-12.2.1N/AN/AN/A
XPS 13 93801.12.04.46.101.063, A027.2.0.2N/A
XPS 15 (9560)1.22.04.26.12.001, A04N/AN/A
XPS 15 2-in-1 (9575)1.14.14.46.144.001, A037.2.0.2N/A
XPS 15 95001.7.14.60.117.022, A00N/AN/A
XPS 15 95701.18.14.46.152.001, A027.2.0.2N/A
XPS 17 97001.7.2N/AN/AN/A
XPS 27 AIO (7760)2.8.1N/AN/AN/A
XPS 75901.9.14.46.110.002, A027.2.0.2N/A
XPS 89002.9.1N/AN/AN/A
XPS 89402.0.11N/AN/AN/A
Dell Dock WD15N/AN/AN/A1.0.8
Dell Dock WD19N/AN/AN/A01.00.15
Dell Thunderbolt Dock TB16N/AN/AN/A1.0.4
Dell Thunderbolt Dock TB18DCN/AN/AN/A1.0.10

Table B: End of Service Life Dell platforms with impacted firmware update utility packages, including BIOS update utilities, Thunderbolt firmware update utilities and TPM firmware update utilities.

 PLATFORMS
Alienware 14Inspiron 580sOptiPlex 780
Alienware 17 51m r2Inspiron 620OptiPlex 790
Alienware Area 51Inspiron 660OptiPlex 9010
Alienware M14xr2Inspiron 660sOptiPlex 9020
Alienware M15 R4Inspiron 7359OptiPlex 9030 AIO
Alienware M17xr4Inspiron 7368OptiPlex 990
Alienware M18xr2Inspiron 7437OptiPlex Fx130
Asm100Inspiron 7520OptiPlex Fx170
Asm100r2Inspiron 7537OptiPlex Xe2
Cheng Ming 3967Inspiron 7548Precision 7510
Dell CanvasInspiron 7558Precision 7710
Dell Latitude 14 Rugged ExtremeInspiron 7559Precision M4600
Inspiron 1122Inspiron 7720Precision M4700
Inspiron 11-3162Inspiron 7737Precision M6600
Inspiron 1210Inspiron 7746Precision M6700
Inspiron 14-3452Inspiron One 19Precision R5500
Inspiron 14-5459Inspiron One 2020Precision T1700
Inspiron 15-3552Latitude 3150Precision T3500
Inspiron 1545Latitude 3160Precision T3600
Inspiron 15-5559Latitude 3310 2in1Precision T3610
Inspiron 15-5565Latitude 3330Precision T5500
Inspiron 1564Latitude 3340Precision T5600
Inspiron 15zLatitude 3350Precision T5610
Inspiron 17-5759Latitude 3440Precision T5810
Inspiron 20-3052Latitude 3450Precision T7500
Inspiron 2330Latitude 3460Precision T7600
Inspiron 24-3452Latitude 3460 Wyse TcPrecision T7610
Inspiron 24-3455Latitude 3550Precision T7810
Inspiron 24-5475Latitude 3560Precision T7910
Inspiron 3043Latitude 5250Vostro 14 3458
Inspiron 3048Latitude 5285Vostro 14-3446
Inspiron 3147Latitude 5450Vostro 1450
Inspiron 3157Latitude 5520Vostro 14-5459
Inspiron 3168Latitude 5550Vostro 15 3561
Inspiron 3252Latitude 7285Vostro 1550
Inspiron 3421Latitude 7350Vostro 20 3052
Inspiron 3437Latitude E5420Vostro 20 3055
Inspiron 3442Latitude E5430Vostro 220s
Inspiron 3443Latitude E5440Vostro 230
Inspiron 3520Latitude E5530Vostro 2521
Inspiron 3521Latitude E5540Vostro 260
Inspiron 3537Latitude E6220Vostro 270
Inspiron 3542Latitude E6230Vostro 270s
Inspiron 3543Latitude E6320Vostro 3010
Inspiron 3646Latitude E6330Vostro 3252
Inspiron 3647Latitude E6430Vostro 3560
Inspiron 3655Latitude E6430 AtgVostro 3800
Inspiron 3656Latitude E6440Vostro 3900
Inspiron 3847Latitude E6530Vostro 3900g
Inspiron 5323Latitude E6540Vostro 3901
Inspiron 5348Latitude E7240Vostro 3902
Inspiron 5423Latitude E7250Vostro 3905
Inspiron 5443Latitude E7270 Wyse TcVostro 470
Inspiron 5448Latitude E7440Vostro 5480
Inspiron 5485 2n1Latitude E7450XPS 13 9343
Inspiron 5520Latitude Xt3XPS 8700
Inspiron 5521OptiPlex 3010XPS 9350
Inspiron 5537OptiPlex 3011 AIOXPS 9530
Inspiron 5543OptiPlex 3020XPS One 2710
Inspiron 5548OptiPlex 3030 AIOXPS  13 9343
Inspiron 5576OptiPlex 390XPS 8700
Inspiron 5577OptiPlex 5055XPS 9350
Inspiron 5676OptiPlex 7010XPS 9530
Inspiron 5737OptiPlex 7020XPS 9550
Inspiron 5749OptiPlex 7090 UltraXPS ONE 2710

Source :
https://www.dell.com/support/kbdoc/it-it/000186019/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability?lang=en

Dell Releases A New Cybersecurity Utility To Detect BIOS Attacks

Computer manufacturing giant Dell has released a new security tool for its commercial customers that aims to protect their computers from stealthy and sophisticated cyberattacks involving the compromise of the BIOS.

Dubbed 'SafeBIOS Events & Indicators of Attack' (IoA), the new endpoint security software is a behavior-based threat detection system that alerts users when BIOS settings of their computers undergo some unusual changes.

BIOS (Basic Input Output System) is a small but highly-privileged program that handles critical operations and starts your computer before handing it over to your operating system.

Protecting the BIOS program is crucial because:

  • Changes to the system BIOS settings could allow malicious software to run during the boot process,
  • Once a hacker takes over the BIOS, he can stealthily control the targeted computer and gain access to the data stored on it,
  • Malware in BIOS remains persistent and doesn't get away even when you format or erase your entire hard drive,
  • Attacks against the BIOS are typically hard to detect because they are invisible to antivirus and other security software installed on the system,
  • With stealth access to one of the compromised systems in an enterprise IT network, sophisticated attackers could move laterally throughout the infrastructure.

According to Dell, the controls offered by SafeBIOS can quickly mitigate the risk of BIOS tampering by bringing them to your attention timely, allowing you to quarantine infected PCs.

"Organizations need the ability to detect when a malicious actor is on the move, altering BIOS configurations on endpoints as part of a larger attack strategy. SafeBIOS now provides the unique ability to generate Indicators of Attack on BIOS configurations, including changes and events that can signal an exploit," David Konetski, VP Client Solutions Group CTO at Dell said in a blog post.

"When BIOS configuration changes are detected that indicate a potential attack, security and IT teams are quickly alerted in their management consoles, allowing for swift isolation and remediation. SafeBIOS Events & IoA provides IT teams the visibility into BIOS configuration changes and analyzes these for potential threats – even during an ongoing attack."

The company says the SafeBIOS Events and Indicators of Attack tool is currently available for Dell commercial PCs through its Dell Trusted Devices solution.

 

Source :
https://thehackernews.com/2020/04/dell-bios-protection.html

https://blog.dellemc.com/en-us/dell-technologies-bolsters-pc-security-todays-remote-workers/