Dell DUP Framework up to 4.9.4.36 on Windows Mount mount point

Summaryinfo

A vulnerability labeled as problematic has been found in Dell DUP Framework up to 4.9.4.36 on Windows. This issue affects some unknown processing of the component Mount Handler. Such manipulation leads to mount point. This vulnerability is traded as CVE-2023-32454. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability was found in Dell DUP Framework up to 4.9.4.36 on Windows and classified as problematic. Affected by this issue is an unknown part of the component Mount Handler. The manipulation with an unknown input leads to a mount point vulnerability. Using CWE to declare the problem leads to CWE-1386. The product opens a file or directory, but it does not properly prevent the name from being associated with a junction or mount point to a destination that is outside of the intended control sphere. Impacted is integrity, and availability. CVE summarizes:

DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A local malicious standard user could exploit the vulnerability to create arbitrary files, leading to denial of service

The weakness was shared 02/06/2024 as dsa-2023-192. The advisory is shared for download at dell.com. This vulnerability is handled as CVE-2023-32454 since 05/09/2023. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/01/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Dell

Name

• DUP Framework

Version

• 4.9.4.0
• 4.9.4.1
• 4.9.4.2
• 4.9.4.3
• 4.9.4.4
• 4.9.4.5
• 4.9.4.6
• 4.9.4.7
• 4.9.4.8
• 4.9.4.9
• 4.9.4.10
• 4.9.4.11
• 4.9.4.12
• 4.9.4.13
• 4.9.4.14
• 4.9.4.15
• 4.9.4.16
• 4.9.4.17
• 4.9.4.18
• 4.9.4.19
• 4.9.4.20
• 4.9.4.21
• 4.9.4.22
• 4.9.4.23
• 4.9.4.24
• 4.9.4.25
• 4.9.4.26
• 4.9.4.27
• 4.9.4.28
• 4.9.4.29
• 4.9.4.30
• 4.9.4.31
• 4.9.4.32
• 4.9.4.33
• 4.9.4.34
• 4.9.4.35
• 4.9.4.36

License

• commercial

Website

• Vendor: https://www.dell.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion