A critical remote code execution vulnerability that exists with SupportAssist Client software allows attackers to gain access to vulnerable machines remotely.
According to Dell, SupportAssist is an Automated, proactive and predictive client support software that checks system health and send the necessary information to Dell, if any issue triggered. The software found in most of the Dell Computers.
It works by running webservers on the local machine in any of the following port 8884, 8883, 8886, or port 8885 based on the availability to establish a connection with Dell website.
Access-Control-Allow-Origin header used for validation purposes, which ensure the local computer is to accept request only from dell.com and not from any other websites.
An independent 17-year-old security researcher, Bill Demirkapi, identified vulnerabilities with integrity check for ClientServiceHandler.ProcessRequest, which allows hackers to bypass the validation and deploy malware on the vulnerable machine.
Bill Demirkapi published a blog post that details various methods to bypass the Referer/Origin check. The Remote Code Execution vulnerability can be tracked as CVE-2019-3719.
SupportAssist Client versions prior to 3.2.0.90 are affected with the vulnerability, users are recommended to update with version 3.2.0.90 and later.
“An unauthenticated attacker, sharing the network access layer with the vulnerable system, can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites,” reads the advisory.
Dell also patched another vulnerability (CVE-2019-3718), which allows an “unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.”
Now Dell addressed both of these vulnerabilities and the customers are recommended to update with SupportAssist Client version 3.2.0.90 and later.
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.
Related Read
ASUS Hack – Here is the List of MAC Addresses Affected in the ShadowHammer Cyberattack – Live Update
