DSA-2024-475: Security Update for Dell Command| Update, Dell Update, Alienware Update, and Dell SupportAssist for an Improper Link Resolution Before File Access Vulnerability
摘要: Dell Inventory Collector remediation is available for an Improper Link Resolution Before File Access Vulnerability in Inventory Collector invoked within Dell Command| Update, Dell Update, Dell Alienware Update, and Dell SupportAssist for PCs (Home and Business) that may be exploited by malicious users to compromise the affected system. ...
本文章適用於
本文章不適用於
本文無關於任何特定產品。
本文未識別所有產品版本。
影響
High
詳細資料
| Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
| CVE-2024-47480 |
Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with local access may exploit this vulnerability, potentially resulting in Elevation of Privileges and unauthorized file system access. |
7.8 |
| Proprietary Code CVEs |
Description |
CVSS Base Score |
CVSS Vector String |
| CVE-2024-47480 |
Dell Inventory Collector Client, versions prior to 12.7.0, contains an Improper Link Resolution Before File Access vulnerability. A low-privilege attacker with local access may exploit this vulnerability, potentially resulting in Elevation of Privileges and unauthorized file system access. |
7.8 |
受影響的產品與補救措施
| Product |
Software/Firmware |
Affected Versions |
Remediated Versions |
Release Date |
Link |
| Dell Inventory Collector |
Software |
Versions prior to 12.7.0 |
Versions 12.7.0 or later |
12/16/2024 |
| Product |
Software/Firmware |
Affected Versions |
Remediated Versions |
Release Date |
Link |
| Dell Inventory Collector |
Software |
Versions prior to 12.7.0 |
Versions 12.7.0 or later |
12/16/2024 |
Dell Command| Update, Dell Update, Alienware Update, and Dell SupportAssist for PCs (Home and Business) automatically updates Inventory Collector without any user interaction. To verify if you are running the remediated version, follow below steps:
- Goto C:\Program Files (x86)\Dell\UpdateService\Service\InvColPC\
- Right Click on invcol.exe, click on Properties, then go to Details tab.
- Verify Product Version is 12.7.0 or later.
- If version is not 12.7.0 or later,
- For SupportAssist,
- Windows Search and select SupportAssist
- Open SupportAssist
- Navigate to “Get Drivers and Downloads” and click on “Run Now”.
- For Dell Command| Update/ Dell Update/ Alienware Update,
- Windows Search and select Dell Command| Update/ Dell Update/ Alienware Update
- Open Dell Command| Update/ Dell Update/ Alienware Update
- Click on “Check”.
- For SupportAssist,
因應措施與緩解措施
None
修訂歷史記錄
|
Revision |
Date |
Description |
|
1.0 |
2024-12-17 |
Initial Release |
感謝
CVE-2024-47480: Dell Technologies would like to thank mdanilor for reporting this issue.
相關資訊
法律免責聲明
受影響的產品
Alienware Update, Dell Command | Update, SupportAssist for Home PCs, Dell Update, SupportAssist for Business PCs文章屬性
文章編號: 000255700
文章類型: Dell Security Advisory
上次修改時間: 17 12月 2024
向其他 Dell 使用者尋求您問題的答案
支援服務
檢查您的裝置是否在支援服務的涵蓋範圍內。