Dell Command Configure CVE-2019-18575 Arbitrary File Overwrite Vulnerability

Description

Dell Command Configure is prone to an arbitrary file-overwrite vulnerability. Successful exploits may allow an attacker to write arbitrary files in the context of the user running the affected application. Dell Command Configure prior to 4.2.1 are vulnerable.

Technologies Affected

• Dell Command Configure (DCC) 4.2.0

Recommendations

Permit local access for trusted individuals only. Where possible, use restricted environments and restricted shells.
Ensure that only trusted users have local, interactive access to affected computers.

Run all software as a nonprivileged user with minimal access rights.
To reduce the impact of latent vulnerabilities, run the application with the minimal amount of privileges required for functionality.

Updates are available. Please see the references or vendor advisory for more information.