Privilege Escalation Vulnerability in Dell/Alienware Digital Delivery
CVE-2019-3742

7.8HIGH

Key Information:

Vendor
Dell
Status
Dell Digital Delivery
Alienware Digital Delivery
Vendor
CVE Published:
9 August 2019

Summary

Dell/Alienware Digital Delivery prior to version 3.5.2013 has a security flaw that allows local non-privileged attackers to exploit a named pipe for binary deserialization. By leveraging process hollowing techniques, a malicious user could inject harmful code, enabling the execution of arbitrary code with elevated privileges.

Affected Version(s)

Alienware Digital Delivery prior to 3.5.2013

Dell Digital Delivery prior to 3.5.2013

References

https://www.dell.com/support/article/SLN318085
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dell would like to thank Alexander Bolshev, Security Consultant, IOActive and Enrique Nissim, Senior Security Consultant, IOActive for reporting these vulnerabilities.
.