DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities
Resumo: Dell SupportAssist Client has been updated to address multiple vulnerabilities which may be potentially exploited to compromise the system.
Este artigo aplica-se a
Este artigo não se aplica a
Este artigo não está vinculado a nenhum produto específico.
Nem todas as versões do produto estão identificadas neste artigo.
Impacto
High
Dados
Improper Origin Validation (CVE-2019-3718)
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.
CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Remote Code Execution Vulnerability (CVE-2019-3719)
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.
CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Improper Origin Validation (CVE-2019-3718)
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.
CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Remote Code Execution Vulnerability (CVE-2019-3719)
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.
CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Produtos afetados e soluções
Affected products:
Dell SupportAssist Client versions prior to 3.2.0.90.
Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:
- Dell SupportAssist Client version 3.2.0.90 and later.
Dell recommends all customers upgrade at the earliest opportunity.
Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.
Affected products:
Dell SupportAssist Client versions prior to 3.2.0.90.
Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:
- Dell SupportAssist Client version 3.2.0.90 and later.
Dell recommends all customers upgrade at the earliest opportunity.
Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.
Agradecimentos
Dell would like to thank John C. Hennessy-ReCar for reporting CVE-2019-3718 and Bill Demirkapi for reporting CVE-2019-3719.
Informações relacionadas
Aviso de isenção legal
Produtos afetados
SupportAssist for Home PCs, SupportAssist for Business PCsPropriedades do artigo
Número do artigo: 000147397
Tipo de artigo: Dell Security Advisory
Último modificado: 18 ago. 2025
Encontre as respostas de outros usuários da Dell para suas perguntas.
Serviços de suporte
Verifique se o dispositivo está coberto pelos serviços de suporte.