A new vulnerability affecting Millions of Dell computers has been found. This issue effects both home and business computers. Dell’s built-in support tool of Dell SuppoortAssist (all versions) has a vulnerability that allows for rights escalation. The issue is, a user who is are not administrators can exploit this vulnerability and gain administrative rights to the computers. Once administrative rights are granted, the unauthorized user is now free to see everything on the computer and can also install malware on the system to spy on the user.
The reason users should not have administrative rights to their computers is to prevent unauthorized access or malicious software from being installed. I have presented on this topic many times. Even home users should not be using an account with administrative right on their computer. The only time administrative rights are needed and should be used, is to install new software or perform other administrative tasks on that system. Another benefit of having non-administrative accounts on a computer, even a home computer, is the ability quickly recover a computer should a user profile become infected or corrupt.
Dell licenses their desktop support tool from PC-Doctor. SafeBreach Labs identified the vulnerability. Dell was notified of the issue on April 29, 2019 and PC-Doctor provided an update on May 28th. Dell is encouraging all their users to update to the new version of Dell SuppoortAssist. For more on performing the update, go to Dells’ support site and look up DSA-2019-084. This has been given CVE Identifier: CVE-2019-12280.
If you would like more information, contact us here or call 937.885.7272.
Follow us on Facebook, Twitter and LinkedIn and stay up to date on by subscribing to our email list.
