Privilege Escalation Vulnerability in Dell/Alienware Digital Delivery
CVE-2019-3744

7.8HIGH

Key Information:

Vendor
Dell
Status
Dell Digital Delivery
Alienware Digital Delivery
Vendor
CVE Published:
9 August 2019

Summary

The Dell/Alienware Digital Delivery application has a vulnerability that allows local non-privileged users to exploit a flaw in the software installation process. By taking advantage of a race condition combined with a path traversal issue, an attacker could manipulate the installation package of a Universal Windows Platform application. This could result in the execution of arbitrary code with elevated privileges, posing security risks to affected systems.

Affected Version(s)

Alienware Digital Delivery prior to 4.0.41

Dell Digital Delivery prior to 4.0.41

References

https://www.dell.com/support/article/SLN318085
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dell would like to thank Alexander Bolshev, Security Consultant, IOActive and Enrique Nissim, Senior Security Consultant, IOActive for reporting these vulnerabilities.
.