HP Support Assistant Vulnerabilities

Security researcher have released details of ten vulnerabilities in HP's Support Assistant for Microsoft Windows, a free tool for managing users product warranties, automate support and updates, and connect to HP devices. The researchers claim that an attacker could exploit the vulnerabilities to remotely execute code, escalate their privileges, or delete local files.

Threat ID:: CC-3421
Category:
Threat Severity:: Low
Threat Vector:
Published:: 8 April 2020 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Affected platforms

The following platforms are known to be affected:

HP Support Assistant - All versions

Threat details

The vulnerabilities can be attributed to several different underlying faults, but all appear to be the result of HP Support Assistant requiring input from unprivileged processes in order to function properly. These processes mean that HP Support Assistant cannot verify the inputs in any manner, making it trivially easy for an attacker to pass any malicious input they wish to the application.

Remediation steps

Type	Step
	At the time of publication, HP has only provided updates to address seven of the 10 vulnerabilities, leaving three of the privilege escalation vulnerabilities unpatched. Affected organisations can only fully protect themselves by removing or disabling HP Support Assistant and HP Support Solutions Framework until such time as these remaining vulnerabilities are addressed. It should also be noted that HP Support Assistant does not provide any additional functionality beyond that available in Windows by default.

Type

Step

At the time of publication, HP has only provided updates to address seven of the 10 vulnerabilities, leaving three of the privilege escalation vulnerabilities unpatched. Affected organisations can only fully protect themselves by removing or disabling HP Support Assistant and HP Support Solutions Framework until such time as these remaining vulnerabilities are addressed. It should also be noted that HP Support Assistant does not provide any additional functionality beyond that available in Windows by default.

Last edited: 29 June 2021 12:01 pm