PT-2019-12732 · Dell+1 · Dell Support+2

Publicado 2019-06-21 · Atualizado 2019-06-26 · CVE-2019-12280

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PC-Doctor Toolbox versions prior to 7.3 Dell SupportAssist versions prior to 2.0.1 (for Business PCs) Dell SupportAssist versions prior to 3.2.2 (for Home PCs)

Description The issue concerns an uncontrolled search path element in the PC-Doctor Toolbox and a security flaw in the pre-installed Dell Support Software. This flaw affects millions of users, as the software comes pre-installed on most Dell computers.

Recommendations For PC-Doctor Toolbox versions prior to 7.3, update to version 7.3 or later. For Dell SupportAssist versions prior to 2.0.1 (for Business PCs), update to version 2.0.1. For Dell SupportAssist versions prior to 3.2.2 (for Home PCs), update to version 3.2.2.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

CVE-2019-12280

Produtos afetados

Dell Support

Dell Supportassist

Pc-Doctor Toolbox

Referências · 14

• http://packetstormsecurity.com/files/153374/PC-Doctor-Toolbox-DLL-Hijacking.html · Nota
• https://t.me/defcon_news/17035 · Publicação no Telegram
• https://seclists.org/fulldisclosure/2019/Jun/29 · Nota
• https://t.me/secharvester/6591 · Publicação no Telegram
• https://dell.com/support/article/il/en/ilbsdt1/sln317291/dsa-2019-084-dell-supportassist-for-business-pcs-and-dell-supportassist-for-home-pcs-security-update-for-pc-doctor-vulnerability?lang=en · Nota
• https://safebreach.com/Press-Post/SafeBreach-Identifies-Serious-Vulnerability-In-PC-Doctor-Software · Nota
• http://securityfocus.com/bid/108880 · Nota
• https://osv.dev/vulnerability/CVE-2019-12280 · Aviso do Fabricante
• https://us-cert.gov/ncas/current-activity/2019/06/21/Dell-Releases-Security-Advisory-Dell-SupportAssist · Nota
• https://t.me/thehackernews/348 · Publicação no Telegram
• http://seclists.org/fulldisclosure/2019/Jun/29 · Nota
• https://t.me/rnetsec/9769 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-12280 · Nota de Segurança
• http://pc-doctor.com/company/pr-articles/130-pc-doctor-responds-to-software-vulnerability-report · Aviso do Fabricante