PT-2015-5676 · Lenovo · Lenovo System Update

Publicado 2015-05-12 · Atualizado 2016-12-03 · CVE-2015-2233

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034

Description The issue arises from improper validation of CA chains during signature validation, allowing man-in-the-middle attackers to upload and execute arbitrary files using a crafted certificate.

Recommendations For versions prior to 5.06.0034, update to version 5.06.0034 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2015-2233

Produtos afetados

Lenovo System Update

Referências · 5

• http://securitytracker.com/id/1032268 · Nota
• http://support.lenovo.com/us/en/product_security/lsu_privilege · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2233 · Nota de Segurança
• http://ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf · Nota
• http://securityfocus.com/bid/74642 · Nota