PT-2017-7321 · Lenovo · Lenovo System Update

Publicado 2017-04-24 · Atualizado 2017-04-28 · CVE-2015-8110

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.07.0019

Description A local privilege escalation issue exists, allowing local users to gain privileges. This can be achieved by navigating to specific links, such as "Click here to learn more" or "View privacy policy", within the Tvsukernel.exe GUI application when using a temporary administrator account.

Recommendations For versions prior to 5.07.0019, update to version 5.07.0019 or later to resolve the issue. As a temporary workaround, consider restricting access to the Tvsukernel.exe GUI application to minimize the risk of exploitation.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-8110

Produtos afetados

Lenovo System Update

Referências · 4

• 🔥 https://ioactive.com/pdfs/IOActive_Advisory_Lenovo_TVSUkernel-Escalation-Privileges.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-8110 · Nota de Segurança
• http://securityfocus.com/bid/98037 · Nota
• https://support.lenovo.com/us/en/product_security/lsu_privilege · Aviso do Fabricante