CVE-2021-36286: Path Traversal
First published: Tue Aug 31 2021(Updated: )
Dell SupportAssist Client Consumer versions 3.9.13.0 and any versions prior to 3.9.13.0 contain an arbitrary file deletion vulnerability that can be exploited by using the Windows feature of NTFS called Symbolic links. Symbolic links can be created by any(non-privileged) user under some object directories, but by themselves are not sufficient to successfully escalate privileges. However, combining them with a different object, such as the NTFS junction point allows for the exploitation. Support assist clean files functionality do not distinguish junction points from the physical folder and proceeds to clean the target of the junction that allows nonprivileged users to create junction points and delete arbitrary files on the system which can be accessed only by the admin.
Credit: security_alert@emc.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dell SupportAssist | <=3.9.13.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2021-36286?
CVE-2021-36286 is rated as critical due to its potential for arbitrary file deletion by unprivileged users.
How do I fix CVE-2021-36286?
To fix CVE-2021-36286, users should upgrade to Dell SupportAssist Client Consumer version 3.9.13.0 or later.
What versions of Dell SupportAssist are affected by CVE-2021-36286?
CVE-2021-36286 affects Dell SupportAssist Client Consumer versions prior to 3.9.13.0.
Can unprivileged users exploit CVE-2021-36286?
Yes, CVE-2021-36286 can be exploited by any non-privileged user due to the use of symbolic links.
What type of vulnerability is CVE-2021-36286?
CVE-2021-36286 is an arbitrary file deletion vulnerability.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/dell
- canonical/dell supportassist
- version/dell supportassist/3.9.13.0