Allele Security Alert
ASA-2019-00262
Identifier(s)
ASA-2019-00262, CVE-2019-3719, DSA-2019-051
Title
Remote Code Execution Vulnerability
Vendor(s)
Dell
Product(s)
Dell SupportAssist Client
Affected version(s)
Dell SupportAssist Client versions prior to 3.2.0.90
Fixed version(s)
Dell SupportAssist Client version 3.2.0.90 and later
Proof of concept
Yes
Description
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.
Technical details
Unknown
Credits
Bill Demirkapi
Reference(s)
DSA-2019-051: Dell SupportAssist Client Multiple Vulnerabilities
https://www.dell.com/support/article/us/en/04/sln316857/dsa-2019-051-dell-supportassist-client-multiple-vulnerabilities?lang=en
Remote Code Execution on most Dell computers
https://d4stiny.github.io/Remote-Code-Execution-on-most-Dell-computers/
Dell SupportAssist RCE Proof of Concept
https://github.com/D4stiny/Dell-Support-Assist-RCE-PoC
CVE-2019-3719
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3719
CVE-2019-3719
https://nvd.nist.gov/vuln/detail/CVE-2019-3719
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: May 11, 2019