DSA-2019-096: Dell/Alienware Digital Delivery Security Update for Privilege Escalation Vulnerabilities
摘要: Dell Digital Delivery and Alienware Digital Delivery have been updated to address two vulnerabilities which may be potentially exploited to cause a privilege escalation with the ability for a non-privileged user to run an executable as SYSTEM. ...
本文章適用於
本文章不適用於
本文無關於任何特定產品。
本文未識別所有產品版本。
影響
High
詳細資料
-
Privilege escalation vulnerability (CVE-2019-3742)
Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) -
Privilege escalation vulnerability (CVE-2019-3744)
Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
-
Privilege escalation vulnerability (CVE-2019-3742)
Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) -
Privilege escalation vulnerability (CVE-2019-3744)
Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
受影響的產品與補救措施
Affected products:
Dell Digital Delivery versions prior to 3.5.2013
Dell Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Alienware Digital Delivery versions prior to 3.5.2013
Alienware Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Resolution:
The following Dell/Alienware Digital Delivery releases contain a resolution to these vulnerabilities:
- Dell Digital Delivery versions 3.5.2013 and later
- Dell Digital Delivery versions 4.0.41 and later
- Alienware Digital Delivery versions 3.5.2013 and later
- Alienware Digital Delivery versions 4.0.41 and later
Please visit the Dell Support Drivers and Downloads site for updates on the applicable products.
Affected products:
Dell Digital Delivery versions prior to 3.5.2013
Dell Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Alienware Digital Delivery versions prior to 3.5.2013
Alienware Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Resolution:
The following Dell/Alienware Digital Delivery releases contain a resolution to these vulnerabilities:
- Dell Digital Delivery versions 3.5.2013 and later
- Dell Digital Delivery versions 4.0.41 and later
- Alienware Digital Delivery versions 3.5.2013 and later
- Alienware Digital Delivery versions 4.0.41 and later
Please visit the Dell Support Drivers and Downloads site for updates on the applicable products.
感謝
Dell would like to thank Alexander Bolshev, Security Consultant, IOActive and Enrique Nissim, Senior Security Consultant, IOActive for reporting these vulnerabilities.
相關資訊
法律免責聲明
受影響的產品
Alienware文章屬性
文章編號: 000145430
文章類型: Dell Security Advisory
上次修改時間: 18 8月 2025
向其他 Dell 使用者尋求您問題的答案
支援服務
檢查您的裝置是否在支援服務的涵蓋範圍內。