PT-2016-6326 · Lenovo · Lenovo Solution Center

Publicado 2016-06-30 · Atualizado 2016-07-01 · CVE-2016-5249

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo Solution Center versions prior to 3.3.003

Description The issue allows local users to execute arbitrary code with LocalSystem privileges. This can be achieved via vectors involving the LSC.Services.SystemService StartProxy command, where a named pipe is created in advance and a crafted .NET assembly is used.

Recommendations For versions prior to 3.3.003, update to version 3.3.003 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-5249

Produtos afetados

Lenovo Solution Center

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-5249 · Nota de Segurança
• https://support.lenovo.com/us/en/product_security/len_7814 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-5249 · Aviso do Fabricante
• https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-012/?fid=8073 · Nota