{"id":3081,"date":"2021-05-06T11:34:40","date_gmt":"2021-05-06T11:34:40","guid":{"rendered":"https:\/\/partnernews.sophos.com\/fr-fr\/?p=3081"},"modified":"2021-09-21T14:38:38","modified_gmt":"2021-09-21T14:38:38","slug":"using-sophos-edr-to-identify-endpoints-impacted-by-dell-kernel-driver-vulnerability-cve-2021-21551","status":"publish","type":"post","link":"https:\/\/partnernews.sophos.com\/fr-fr\/2021\/05\/resources\/using-sophos-edr-to-identify-endpoints-impacted-by-dell-kernel-driver-vulnerability-cve-2021-21551\/","title":{"rendered":"Comment utiliser Sophos EDR pour identifier la vuln\u00e9rabilit\u00e9 CVE-2021-21551 (pilote du noyau Dell)\u00a0?"},"content":{"rendered":"<p>Plusieurs exploits ont \u00e9t\u00e9 d\u00e9couverts dans l\u2019un des pilotes du noyau Windows de Dell. Les cinq bugs associ\u00e9s, qui peuvent entra\u00eener une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service ou la divulgation d\u2019informations, sont collectivement class\u00e9s sous la d\u00e9signation CVE-2021-21551.<\/p>\n<p>Dell a publi\u00e9 un <a href=\"https:\/\/www.dell.com\/support\/kbdoc\/en-uk\/000186019\/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability\">correctif pour ces vuln\u00e9rabilit\u00e9s<\/a> le 4\u00a0mai 2021 et nous vous recommandons de l\u2019installer le plus t\u00f4t possible.<\/p>\n<p>Les bugs remontent \u00e0 2009 et la liste officielle de Dell des produits concern\u00e9s s\u2019\u00e9tend sur plusieurs pages. Par cons\u00e9quent, le d\u00e9fi pour les \u00e9quipes IT consiste \u00e0 d\u00e9terminer si votre entreprise est concern\u00e9e par ce probl\u00e8me, estimer l\u2019\u00e9tendue des d\u00e9g\u00e2ts potentiels et optimiser, de mani\u00e8re appropri\u00e9e, le temps et les efforts consacr\u00e9s \u00e0 la rem\u00e9diation.<\/p>\n<h2>Requ\u00eate avec Sophos EDR<\/h2>\n<p><a href=\"https:\/\/www.sophos.com\/fr-fr\/products\/endpoint-antivirus\/edr.aspx\">Sophos EDR<\/a> (Endpoint Detection and Response) permet d\u2019identifier facilement si vous poss\u00e9dez le fichier associ\u00e9 \u00e0 cette vuln\u00e9rabilit\u00e9 sur un appareil, et combien d\u2019appareils poss\u00e8dent v\u00e9ritablement ce fichier. Cette mani\u00e8re de proc\u00e9der vous permet de concentrer vos efforts de rem\u00e9diation efficacement et de r\u00e9soudre ainsi rapidement le probl\u00e8me.<\/p>\n<p>Nous avons cr\u00e9\u00e9 une requ\u00eate EDR personnalis\u00e9e qui identifie les syst\u00e8mes endpoint au niveau de votre domaine qui n\u00e9cessitent votre attention. Elle confirme \u00e9galement ceux qui <em>ne poss\u00e8dent pas<\/em> le fichier associ\u00e9 \u00e0 CVE-2021-21551.<\/p>\n<p>Rendez-vous dans le Centre d\u2019analyse des menaces dans Sophos Central, s\u00e9lectionnez Live Discover et cr\u00e9ez une nouvelle requ\u00eate.<\/p>\n<figure id=\"attachment_74908\" class=\"wp-caption aligncenter\" aria-describedby=\"caption-attachment-74908\"><a href=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-74908 size-full\" src=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png\" sizes=\"auto, (max-width: 3094px) 100vw, 3094px\" srcset=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png 3094w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png?resize=300,255 300w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png?resize=768,652 768w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png?resize=1024,870 1024w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png?resize=1536,1305 1536w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/EDR-create-query.png?resize=2048,1740 2048w\" alt=\"\" width=\"3094\" height=\"2628\" \/><\/a><figcaption id=\"caption-attachment-74908\" class=\"wp-caption-text\">S\u00e9lectionnez \u00ab\u00a0Cr\u00e9er une nouvelle demande\u00a0\u00bb<\/figcaption><\/figure>\n<p>Ensuite, copiez et collez la requ\u00eate ci-dessous\u00a0:<\/p>\n<pre>\u00a0 -- Check if the dbutil_2_3.sys file is present or not <strong>SELECT<\/strong> \u00a0 \u00a0<strong>CASE<\/strong>\u00a0<strong>WHEN<\/strong>\u00a0(<strong>SELECT<\/strong>\u00a01 <strong>FROM<\/strong>\u00a0<strong>file<\/strong>\u00a0<strong>WHERE<\/strong>\u00a0path <strong>LIKE<\/strong>\u00a0'C:\\Users\\%\\AppData\\Local\\Temp\\dbutil_2_3.sys'\u00a0<strong>OR<\/strong>\u00a0path <strong>LIKE<\/strong>\u00a0'C:\\Windows\\Temp\\dbutil_2_3.sys') = 1 \u00a0 \u00a0 \u00a0 <strong>THEN<\/strong> 'SYSTEM REQUIRES ATTENTION: File for CVE-2021-21551 (dbutil_2.3.sys) located in directory '|| (<strong>SELECT<\/strong>\u00a0<strong>directory<\/strong>\u00a0<strong>FROM<\/strong>\u00a0<strong>file<\/strong>\u00a0<strong>WHERE<\/strong>\u00a0path <strong>LIKE<\/strong>\u00a0'C:\\Users\\%\\AppData\\Local\\Temp\\dbutil_2_3.sys'\u00a0<strong>OR<\/strong>\u00a0path <strong>LIKE<\/strong>\u00a0'C:\\Windows\\Temp\\dbutil_2_3.sys') \u00a0 \u00a0 \u00a0 <strong>ELSE<\/strong> 'File for CVE-2021-21551 (dbutil_2_3.sys) not found' \u00a0 <strong>END<\/strong>\u00a0Status<\/pre>\n<p>&nbsp;<\/p>\n<p><a href=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-74916 size-full\" src=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" srcset=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png 3094w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png?resize=300,255 300w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png?resize=768,652 768w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png?resize=1024,870 1024w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png?resize=1536,1305 1536w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Paste-query.png?resize=2048,1740 2048w\" alt=\"\" width=\"640\" height=\"544\" \/><\/a><\/p>\n<p>Puis, ex\u00e9cutez la requ\u00eate au niveau de votre domaine.<\/p>\n<p><a href=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-74917 size-full\" src=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png\" sizes=\"auto, (max-width: 640px) 100vw, 640px\" srcset=\"https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png 3094w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png?resize=300,255 300w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png?resize=768,652 768w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png?resize=1024,870 1024w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png?resize=1536,1305 1536w, https:\/\/news.sophos.com\/wp-content\/uploads\/2021\/05\/Run-query.png?resize=2048,1740 2048w\" alt=\"\" width=\"640\" height=\"544\" \/><\/a><\/p>\n<h2>Rem\u00e9diation des appareils concern\u00e9s<\/h2>\n<p>Dell <a href=\"https:\/\/www.dell.com\/support\/kbdoc\/en-uk\/000186019\/dsa-2021-088-dell-client-platform-security-update-for-dell-driver-insufficient-access-control-vulnerability\">a fourni des instructions<\/a> pour supprimer manuellement le pilote de noyau affect\u00e9, qui, selon lui, se trouvera dans l\u2019un des deux emplacements suivants :<\/p>\n<ul>\n<li>C:\\Users\\%USERNAME%\\AppData\\Local\\Temp\\dbutil_2_3.sys<\/li>\n<li>C:\\Windows\\Temp\\dbutil_2_3.sys<\/li>\n<\/ul>\n<p>Si la suppression manuelle des fichiers syst\u00e8me vous inqui\u00e8te, Dell a mis \u00e0 disposition <a href=\"https:\/\/www.dell.com\/support\/home\/en-uk\/drivers\/driversdetails?driverid=7PR57\">une page de t\u00e9l\u00e9chargement<\/a> avec un outil de suppression automatique des pilotes.<\/p>\n<h2>En savoir plus<\/h2>\n<p>Pour obtenir plus d\u2019informations sur cette vuln\u00e9rabilit\u00e9 et comment elle peut \u00eatre exploit\u00e9e, parcourez l\u2019<a href=\"https:\/\/nakedsecurity.sophos.com\/2021\/05\/05\/dell-fixes-exploitable-holes-its-own-firmware-update-driver-patch-now\/\">article publi\u00e9 sur notre blog Sophos Naked Security<\/a>.<\/p>\n<p><a href=\"https:\/\/www.sophos.com\/fr-fr\/products\/endpoint-antivirus\/edr.aspx\">Sophos EDR <\/a>est disponible pour les syst\u00e8mes endpoint et les serveurs et est inclus dans les abonnements Intercept X. Vous pouvez l\u2019utiliser gratuitement pendant 30\u00a0jours\u00a0:<\/p>\n<ul>\n<li>Les clients Sophos utilisant Sophos Central peuvent b\u00e9n\u00e9ficier d\u2019un essai gratuit directement depuis leur console de gestion. S\u00e9lectionnez simplement \u00ab\u00a0Essais gratuits\u00a0\u00bb en bas de la barre de navigation de gauche.<\/li>\n<li>Pour ceux qui n\u2019utilisent pas Sophos, vous pouvez b\u00e9n\u00e9ficier d\u2019<a href=\"https:\/\/www.sophos.com\/fr-fr\/products\/free-trials.aspx\">un essai gratuit<\/a> via notre site Web.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Vous pouvez utiliser cette requ\u00eate pour identifier les syst\u00e8mes endpoint dont le fichier est associ\u00e9 \u00e0 CVE-2021-21551 ainsi que ceux qui ne sont pas concern\u00e9s.<\/p>\n","protected":false},"author":11,"featured_media":3000003401,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[77],"tags":[21,54],"coauthors":[43],"class_list":["post-3081","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-resources","tag-menaces-malwares","tag-sophos-edr"],"jetpack_featured_media_url":"https:\/\/partnernews.sophos.com\/en-us\/wp-content\/uploads\/sites\/3\/2021\/07\/featured-image-sophos-endpopint-detection-and-response-app-icon-1600x960px.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/posts\/3081","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/comments?post=3081"}],"version-history":[{"count":1,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/posts\/3081\/revisions"}],"predecessor-version":[{"id":3098,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/posts\/3081\/revisions\/3098"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/media?parent=3081"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/categories?post=3081"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/tags?post=3081"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/partnernews.sophos.com\/fr-fr\/wp-json\/wp\/v2\/coauthors?post=3081"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}