DSA-2019-096: Dell/Alienware Digital Delivery Security Update for Privilege Escalation Vulnerabilities

Riepilogo: Dell Digital Delivery and Alienware Digital Delivery have been updated to address two vulnerabilities which may be potentially exploited to cause a privilege escalation with the ability for a non-privileged user to run an executable as SYSTEM. ...

Questo articolo si applica a Questo articolo non si applica a Questo articolo non è legato a un prodotto specifico. Non tutte le versioni del prodotto sono identificate in questo articolo.
Scopri le altre risorse

Impatto

High

Dettagli

  • Privilege escalation vulnerability (CVE-2019-3742)

    Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.

    CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

  • Privilege escalation vulnerability (CVE-2019-3744)

    Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.

    CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

  • Privilege escalation vulnerability (CVE-2019-3742)

    Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.

    CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

  • Privilege escalation vulnerability (CVE-2019-3744)

    Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.

    CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Dell Technologies raccomanda a tutti i clienti di prendere in considerazione sia il punteggio base CVSS, sia ogni eventuale punteggio temporale o ambientale che possa avere effetti sul livello di gravità potenziale associato a una specifica vulnerabilità di sicurezza.

Prodotti interessati e correzione

Affected products:
Dell Digital Delivery versions prior to 3.5.2013
Dell Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Alienware Digital Delivery versions prior to 3.5.2013
Alienware Digital Delivery versions prior to 4.0.41 (Microsoft Store)

Resolution:

The following Dell/Alienware Digital Delivery releases contain a resolution to these vulnerabilities:

  • Dell Digital Delivery versions 3.5.2013 and later
  • Dell Digital Delivery versions 4.0.41 and later
  • Alienware Digital Delivery versions 3.5.2013 and later
  • Alienware Digital Delivery versions 4.0.41 and later
Dell recommends all customers upgrade at the earliest opportunity.

Please visit the Dell Support Drivers and Downloads site for updates on the applicable products.

 

Affected products:
Dell Digital Delivery versions prior to 3.5.2013
Dell Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Alienware Digital Delivery versions prior to 3.5.2013
Alienware Digital Delivery versions prior to 4.0.41 (Microsoft Store)

Resolution:

The following Dell/Alienware Digital Delivery releases contain a resolution to these vulnerabilities:

  • Dell Digital Delivery versions 3.5.2013 and later
  • Dell Digital Delivery versions 4.0.41 and later
  • Alienware Digital Delivery versions 3.5.2013 and later
  • Alienware Digital Delivery versions 4.0.41 and later
Dell recommends all customers upgrade at the earliest opportunity.

Please visit the Dell Support Drivers and Downloads site for updates on the applicable products.

 

Ringraziamenti

Dell would like to thank Alexander Bolshev, Security Consultant, IOActive and Enrique Nissim, Senior Security Consultant, IOActive for reporting these vulnerabilities.

Informazioni correlate

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide

Dichiarazione di non responsabilità

Prodotti interessati

Alienware
Proprietà dell'articolo
Numero articolo: 000145430
Tipo di articolo: Dell Security Advisory
Ultima modifica: 18 ago 2025
Trova risposta alle tue domande dagli altri utenti Dell
Support Services
Verifica che il dispositivo sia coperto dai Servizi di supporto.