Passa al contenuto principale
  • Effettua gli ordini in modo rapido e semplice
  • Visualizza gli ordini e monitora lo stato della spedizione
  • Crea e accedi a un elenco dei tuoi prodotti
  • Gestisci i siti, i prodotti e i contatti per livello di prodotto di Dell EMC tramite l'amministrazione della società.

Numero articolo: 000147397


DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities

Riepilogo: Dell SupportAssist Client has been updated to address multiple vulnerabilities which may be potentially exploited to compromise the system.

Contenuto dell'articolo


Impatto

High

Dettagli

Improper Origin Validation (CVE-2019-3718)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability.    An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.

CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)

 

Remote Code Execution Vulnerability (CVE-2019-3719)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.

CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Improper Origin Validation (CVE-2019-3718)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability.    An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.

CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)

 

Remote Code Execution Vulnerability (CVE-2019-3719)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.

CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Dell Technologies raccomanda a tutti i clienti di prendere in considerazione sia il punteggio base CVSS, sia ogni eventuale punteggio temporale o ambientale che possa avere effetti sul livello di gravità potenziale associato a una specifica vulnerabilità di sicurezza.

Prodotti interessati e correzione

Affected products:

Dell SupportAssist Client versions prior to 3.2.0.90.


Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:

  • Dell SupportAssist Client version 3.2.0.90 and later.

Dell recommends all customers upgrade at the earliest opportunity.

Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.

Affected products:

Dell SupportAssist Client versions prior to 3.2.0.90.


Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:

  • Dell SupportAssist Client version 3.2.0.90 and later.

Dell recommends all customers upgrade at the earliest opportunity.

Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.

Ringraziamenti

Dell would like to thank John C. Hennessy-ReCar for reporting CVE-2019-3718 and Bill Demirkapi for reporting CVE-2019-3719.

 

Informazioni correlate

Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide


Proprietà articolo


Prodotto interessato

SupportAssist for Home PCs, SupportAssist for Business PCs

Ultima data di pubblicazione

21 feb 2021

Versione

4

Tipo di articolo

Dell Security Advisory