CVE-2019-3742

Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.dell.com/support/article/SLN318085	Vendor Advisory
https://www.dell.com/support/article/SLN318085	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:digital_delivery::::::::
	cpe:2.3:a:dell:digital_delivery::::::::

History

No history.

Information

Published : 2019-08-09 19:15

Updated : 2024-11-21 04:42

NVD link : CVE-2019-3742

Mitre link : CVE-2019-3742

CVE.ORG link : CVE-2019-3742

JSON object : View

Products Affected

dell

digital_delivery

CWE

NVD-CWE-noinfo

{"id": "CVE-2019-3742", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-08-09T19:15:11.673", "references": [{"url": "https://www.dell.com/support/article/SLN318085", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/article/SLN318085", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Dell/Alienware Digital Delivery versions prior to 3.5.2013 contain a privilege escalation vulnerability. A local non-privileged malicious user could exploit a named pipe that performs binary deserialization via a process hollowing technique to inject malicous code to run an executable with elevated privileges."}, {"lang": "es", "value": "Dell/Alienware Digital Delivery en versiones anteriores a 3.5.2013, contiene una vulnerabilidad de escalamiento de privilegios. Un usuario malicioso local no privilegiado podr\u00eda explotar una tuber\u00eda nombrada que realiza la deserializaci\u00f3n binaria mediante una t\u00e9cnica de vaciado del proceso para inyectar c\u00f3digo malicioso y correr un ejecutable con privilegios elevados"}], "lastModified": "2024-11-21T04:42:26.990", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:digital_delivery:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "658B02CD-52B7-4A50-9C2D-49DD2383D4FF", "versionEndExcluding": "3.5.2013"}, {"criteria": "cpe:2.3:a:dell:digital_delivery:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "36EDF49F-DC2A-46C2-B7C5-142D3844178F", "versionEndExcluding": "4.0.41", "versionStartIncluding": "4.0.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}