Dell SupportAssist OS Recovery Symbolic Link Attack Vulnerability Allowing Arbitrary File Deletion and Privilege Escalation

A symbolic link attack vulnerability has been identified in Dell SupportAssist OS Recovery versions prior to 5.5.13.1. This vulnerability allows a low-privileged attacker with local access to exploit the issue, potentially leading to arbitrary file deletion and elevation of privileges.

Impact

Exploitation of this vulnerability could result in unauthorized file deletion and elevated privileges on the affected system.

Remediation

Users can update to Dell SupportAssist OS Recovery version 5.5.13.1 or later. The application typically auto-updates to the latest version. To verify the installed version, check the 'Programs and Features' section in the Control Panel for 'Dell SupportAssist Remediation' and 'Dell SupportAssist OS Recovery Plugin'. Alternatively, the version can be checked in the 'About' section of the application.