CVE-2019-3726
First published: Tue Sep 24 2019(Updated: )
An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework file versions prior to 103.4.6.69 used in Dell EMC Servers. Dell Update Package (DUP) Framework file versions prior to 3.8.3.67 used in Dell Client Platforms. The vulnerability is limited to the DUP framework during the time window when a DUP is being executed by an administrator. During this time window, a locally authenticated low privilege malicious user potentially could exploit this vulnerability by tricking an administrator into running a trusted binary, causing it to load a malicious DLL and allowing the attacker to execute arbitrary code on the victim system. The vulnerability does not affect the actual binary payload that the DUP delivers.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dell Update Package Framework | <3.8.3.67 | |
| Dell Client Platforms | ||
| Dell Update Package Framework | <103.4.6.69 | |
| Dell EMC Servers | ||
| Dell Update Package Framework | <19.1.0.413 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2019-3726?
CVE-2019-3726 is classified as a medium severity vulnerability.
How do I fix CVE-2019-3726?
To fix CVE-2019-3726, upgrade the Dell Update Package Framework to version 19.1.0.413 or later.
Which software versions are affected by CVE-2019-3726?
CVE-2019-3726 affects Dell Update Package Framework versions prior to 19.1.0.413 and 103.4.6.69.
What type of vulnerability is CVE-2019-3726?
CVE-2019-3726 is categorized as an Uncontrolled Search Path vulnerability.
Is there a known exploit for CVE-2019-3726?
Currently, there are no publicly known exploits for CVE-2019-3726.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/tags
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- vendor/dell
- canonical/dell update package framework
- canonical/dell client platforms
- canonical/dell emc servers