Ga naar hoofdinhoud

DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities

Samenvatting: Dell SupportAssist Client has been updated to address multiple vulnerabilities which may be potentially exploited to compromise the system.

Dit artikel is van toepassing op Dit artikel is niet van toepassing op Dit artikel is niet gebonden aan een specifiek product. Niet alle productversies worden in dit artikel vermeld.

Impact

High

Gegevens

Improper Origin Validation (CVE-2019-3718)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability.    An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.

CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)

 

Remote Code Execution Vulnerability (CVE-2019-3719)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.

CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Improper Origin Validation (CVE-2019-3718)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability.    An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.

CVSSv3 Base Score: 7.6 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H)

 

Remote Code Execution Vulnerability (CVE-2019-3719)

 

Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.

CVSSv3 Base Score: 7.1 (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)

Dell Technologies raadt aan dat alle klanten rekening houden met zowel de basisscore van CVSS als alle relevante tijdelijke en omgevingsscores die gevolgen kunnen hebben voor de mogelijke ernst van de specifieke beveiligingsproblemen.

Getroffen producten en herstel

Affected products:

Dell SupportAssist Client versions prior to 3.2.0.90.


Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:

  • Dell SupportAssist Client version 3.2.0.90 and later.

Dell recommends all customers upgrade at the earliest opportunity.

Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.

Affected products:

Dell SupportAssist Client versions prior to 3.2.0.90.


Remediation:
The following Dell SupportAssist Client release contains resolutions to these vulnerabilities:

  • Dell SupportAssist Client version 3.2.0.90 and later.

Dell recommends all customers upgrade at the earliest opportunity.

Customers can download software from https://downloads.dell.com/serviceability/Catalog/SupportAssistInstaller.exe.

Bevestigingen

Dell would like to thank John C. Hennessy-ReCar for reporting CVE-2019-3718 and Bill Demirkapi for reporting CVE-2019-3719.

 

Verwante informatie

Getroffen producten

SupportAssist for Home PCs, SupportAssist for Business PCs
Artikeleigenschappen
Artikelnummer: 000147397
Artikeltype: Dell Security Advisory
Laatst aangepast: 21 feb. 2021
Vind antwoorden op uw vragen via andere Dell gebruikers
Support Services
Controleer of uw apparaat wordt gedekt door Support Services.