When you boot up using the Dell PowerEdge Installation and Server Management Disc (P/N: WG126 Rev. A00, October 2005), there are two major vulnerabilities on the machine.  If you use this disc to boot up and you are connected to a DHCP network, there is an SSH server running that does not require a username and password to login.  There is also an X11 server running that accepts connections from anywhere.

The reason why these are risks are because anybody can ssh into the machine and get a bash prompt.  The X11 risk is also rather large because you could place a key logger and screenshot viewer on the IP to see what the admin is doing while they install the software.

This could lead to possible server compromise if an administrator password is entered during this installation wizard.

Notified Dell of vulnerability and their response said to either install the OS using Microsoft or Redhat CD's OR use the Openmanage disc without being connected to a network.  This is not documented anywhere on their site.

Mike