PT-2018-18824 · Lenovo · Lenovo System Update

Publicado 2018-05-04 · Atualizado 2018-06-13 · CVE-2018-9063

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.07.0072

Description The issue allows an attacker to potentially execute arbitrary code by entering a very large user ID or password, causing a buffer overrun in the mapdrv.exe program. This can lead to undefined behaviors. The attacker does not gain additional privileges beyond those required to run mapdrv.exe.

Recommendations For versions prior to 5.07.0072, update to version 5.07.0072 or later to resolve the issue. As a temporary workaround, consider restricting input lengths for user ID and password to prevent buffer overruns until a patch is applied.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2018-9063

Produtos afetados

Lenovo System Update

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-9063 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-9063 · Nota de Segurança
• https://support.lenovo.com/us/en/solutions/LEN-19625 · Aviso do Fabricante
• http://securityfocus.com/bid/104125 · Nota