Dell Alienware Digital Delivery up to 4.0.40 Universal Windows Platform access control

Summaryinfo

A vulnerability categorized as critical has been discovered in Dell Alienware Digital Delivery up to 4.0.40. This issue affects some unknown processing of the component Universal Windows Platform. The manipulation results in access control. This vulnerability is known as CVE-2019-3744. Attacking locally is a requirement. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Dell Alienware Digital Delivery up to 4.0.40. Affected is an unknown functionality of the component Universal Windows Platform. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Dell/Alienware Digital Delivery versions prior to 4.0.41 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a Universal Windows Platform application by manipulating the install software package feature with a race condition and a path traversal exploit in order to run a malicious executable with elevated privileges.

The weakness was published 08/09/2019 (Website). The advisory is available at dell.com. This vulnerability is traded as CVE-2019-3744 since 01/03/2019. Local access is required to approach this attack. The successful exploitation needs a authentication. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

Upgrading to version 4.0.41 eliminates this vulnerability.

Similar entry is available at VDB-139769. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Dell Alienware

Name

• Digital Delivery

Version

• 4.0.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.0.5
• 4.0.6
• 4.0.7
• 4.0.8
• 4.0.9
• 4.0.10
• 4.0.11
• 4.0.12
• 4.0.13
• 4.0.14
• 4.0.15
• 4.0.16
• 4.0.17
• 4.0.18
• 4.0.19
• 4.0.20
• 4.0.21
• 4.0.22
• 4.0.23
• 4.0.24
• 4.0.25
• 4.0.26
• 4.0.27
• 4.0.28
• 4.0.29
• 4.0.30
• 4.0.31
• 4.0.32
• 4.0.33
• 4.0.34
• 4.0.35
• 4.0.36
• 4.0.37
• 4.0.38
• 4.0.39
• 4.0.40

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion