PT-2019-12732 · Dell+1 · Dell Support+2

Published 2019-06-21 · Updated 2019-06-26 · CVE-2019-12280

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PC-Doctor Toolbox versions prior to 7.3 Dell SupportAssist versions prior to 2.0.1 (for Business PCs) Dell SupportAssist versions prior to 3.2.2 (for Home PCs)

Description The issue concerns an uncontrolled search path element in the PC-Doctor Toolbox and a security flaw in the pre-installed Dell Support Software. This flaw affects millions of users, as the software comes pre-installed on most Dell computers.

Recommendations For PC-Doctor Toolbox versions prior to 7.3, update to version 7.3 or later. For Dell SupportAssist versions prior to 2.0.1 (for Business PCs), update to version 2.0.1. For Dell SupportAssist versions prior to 3.2.2 (for Home PCs), update to version 3.2.2.

Fix

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

CVE-2019-12280

Affected Products

Dell Support

Dell Supportassist

Pc-Doctor Toolbox

References · 14

• https://osv.dev/vulnerability/CVE-2019-12280 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12280 · Security Note
• http://pc-doctor.com/company/pr-articles/130-pc-doctor-responds-to-software-vulnerability-report · Vendor Advisory
• http://packetstormsecurity.com/files/153374/PC-Doctor-Toolbox-DLL-Hijacking.html · Note
• https://t.me/defcon_news/17035 · Telegram Post
• https://seclists.org/fulldisclosure/2019/Jun/29 · Note
• https://t.me/secharvester/6591 · Telegram Post
• https://dell.com/support/article/il/en/ilbsdt1/sln317291/dsa-2019-084-dell-supportassist-for-business-pcs-and-dell-supportassist-for-home-pcs-security-update-for-pc-doctor-vulnerability?lang=en · Note
• https://safebreach.com/Press-Post/SafeBreach-Identifies-Serious-Vulnerability-In-PC-Doctor-Software · Note
• http://securityfocus.com/bid/108880 · Note
• https://us-cert.gov/ncas/current-activity/2019/06/21/Dell-Releases-Security-Advisory-Dell-SupportAssist · Note
• https://t.me/thehackernews/348 · Telegram Post
• http://seclists.org/fulldisclosure/2019/Jun/29 · Note
• https://t.me/rnetsec/9769 · Telegram Post