Article Number: 000145430
High
Privilege escalation vulnerability (CVE-2019-3742)
Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Privilege escalation vulnerability (CVE-2019-3744)
Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Privilege escalation vulnerability (CVE-2019-3742)
Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Privilege escalation vulnerability (CVE-2019-3744)
Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.
CVSS v3 Base Score: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected products:
Dell Digital Delivery versions prior to 3.5.2013
Dell Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Alienware Digital Delivery versions prior to 3.5.2013
Alienware Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Resolution:
The following Dell/Alienware Digital Delivery releases contain a resolution to these vulnerabilities:
Please visit the Dell Support Drivers and Downloads site for updates on the applicable products.
Affected products:
Dell Digital Delivery versions prior to 3.5.2013
Dell Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Alienware Digital Delivery versions prior to 3.5.2013
Alienware Digital Delivery versions prior to 4.0.41 (Microsoft Store)
Resolution:
The following Dell/Alienware Digital Delivery releases contain a resolution to these vulnerabilities:
Please visit the Dell Support Drivers and Downloads site for updates on the applicable products.
Dell would like to thank Alexander Bolshev, Security Consultant, IOActive and Enrique Nissim, Senior Security Consultant, IOActive for reporting these vulnerabilities.
Alienware
21 Feb 2021
Dell Security Advisory