PT-2021-21205 · Dell · Supportassist Client

Published 2021-09-28 · Updated 2021-10-07 · CVE-2021-36297

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SupportAssist Client versions 3.8 and 3.9

Description The issue allows attackers to load an arbitrary .dll file via .dll planting/hijacking, only by a separate administrative action that is not a default part of the SOSInstallerTool.exe installation for executing arbitrary dll's.

Recommendations For SupportAssist Client versions 3.8 and 3.9, consider disabling the loading of arbitrary .dll files until a patch is available. Restrict access to the SOSInstallerTool.exe installation to minimize the risk of exploitation. Avoid using the SOSInstallerTool.exe for executing arbitrary dll's until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2021-36297

Affected Products

Supportassist Client

References · 7

• https://osv.dev/vulnerability/CVE-2021-36297 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000191057/dsa-2021-163-dell-supportassist-client-consumer-security-update-for-two-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36297 · Security Note
• https://t.me/cvenotify/22057 · Telegram Post
• https://t.me/cvenotify/21599 · Telegram Post
• https://t.me/cvenotify/21593 · Telegram Post
• https://t.me/cibsecurity/29604 · Telegram Post