Security Advisory for Command Injection Vulnerability in Helpdesk

Summary

A command injection vulnerability was recently found in Helpdesk. If exploited, this vulnerability could allow remote attackers to run arbitrary commands in the compromised application.

We have already fixed this issue in Helpdesk version 1.2 and later in the following QTS versions.

• QTS 4.2.6: build 20180711 and later
• QTS 4.3.3: build 20180716 and later
• QTS 4.3.4: build 20180710 and later

Recommendation

To fix these vulnerabilities, we recommend updating QTS first, and then Helpdesk, to their latest versions.

Installing the QTS Update

1. Log on to QTS as administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   QTS downloads and installs the latest available update.

Updating Helpdesk

1. Log on to QTS as administrator.
2. Open the App Center, and then click the Search icon.
   A search box appears.
3. Type “Helpdesk”, and then press ENTER.
   The Helpdesk application appears in the search results list.
4. Click Update.
   A confirmation message appears.
5. Click OK.
   The application is updated.