PT-2015-5677 · Lenovo · Lenovo System Update

Publicado 2015-05-12 · Atualizado 2017-01-03 · CVE-2015-2234

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034

Description A race condition issue exists due to world-writable permissions for the update files directory. This allows local users to gain privileges by writing to an update file after the signature is validated.

Recommendations For versions prior to 5.06.0034, update to version 5.06.0034 or later to resolve the issue.

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2015-2234

Produtos afetados

Lenovo System Update

Referências · 5

• http://securityfocus.com/bid/74634 · Nota
• http://securitytracker.com/id/1032268 · Nota
• http://support.lenovo.com/us/en/product_security/lsu_privilege · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-2234 · Nota de Segurança
• http://ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf · Nota