DSA-2020-108: Dell Dock Firmware Update Utilities Arbitrary File Overwrite Vulnerability

• Arbitrary File Overwrite Vulnerability

CVE-2020-5357

Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time window, a locally authenticated low-privileged malicious user could exploit this vulnerability by tricking an administrator into overwriting arbitrary files via a symlink attack. The vulnerability does not affect the actual binary payload that the update utility delivers.

CVSS Base Score: 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

Affected products:

Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations (see Resolution section below for complete list of affected products)

 

Remediation:

Customers should use the latest releases available from Dell support when updating their systems. Customers do not need to download and rerun update packages if the system is already running the latest BIOS, firmware or driver content.

Dell recommends that customers follow security best practices for malware protection and use security software to help protect against malware (e.g., advanced threat prevention software or anti-virus).

Please visit the Drivers and Downloads site for updates on the applicable products. To learn more, visit the Dell Knowledge Base article Dell BIOS Updates, and download the update for your Dell computer.

• Prior to installing the update, please ensure Windows Updates are up to date.
• The dates listed are subject to change without notice.
• The platform list for Dell Client products will be updated periodically. Please check back frequently for the most up-to-date information.
• Update versions in the table below are the first releases with the updates to address the security vulnerabilities. Releases at and above these versions will include the security updates.
• Release dates below are in U.S. format of MM/DD/YYYY.
• Expected release dates are in the Month YYYY format.

Dell Client Consumer and Commercial Products Affected

The following is a list of impacted products: