DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities
概要: Dell SupportAssist Client has been updated to address multiple vulnerabilities which may be potentially exploited to compromise the system.
この記事は次に適用されます：
この記事は次には適用されません：
この記事は、特定の製品に関連付けられていません。
すべての製品パージョンがこの記事に記載されているわけではありません。
影響
High
詳細
Improper Origin Validation (CVE-2019-3718)
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.
CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Remote Code Execution Vulnerability (CVE-2019-3719)
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.
CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Improper Origin Validation (CVE-2019-3718)
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.
CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)
Remote Code Execution Vulnerability (CVE-2019-3719)
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.
CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
影響を受ける製品と修復
Affected products:
Dell SupportAssist Client versions prior to 3.2.0.90.
Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:
- Dell SupportAssist Client version 3.2.0.90 and later.
Dell recommends all customers upgrade at the earliest opportunity.
Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.
Affected products:
Dell SupportAssist Client versions prior to 3.2.0.90.
Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:
- Dell SupportAssist Client version 3.2.0.90 and later.
Dell recommends all customers upgrade at the earliest opportunity.
Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.
確認
Dell would like to thank John C. Hennessy-ReCar for reporting CVE-2019-3718 and Bill Demirkapi for reporting CVE-2019-3719.
関連情報
法的免責事項
対象製品
SupportAssist for Home PCs, SupportAssist for Business PCs文書のプロパティ
文書番号: 000147397
文書の種類: Dell Security Advisory
最終更新: 18 8月 2025
質問に対する他のDellユーザーからの回答を見つける
サポート サービス
お使いのデバイスがサポート サービスの対象かどうかを確認してください。