PT-2015-5676 · Lenovo · Lenovo System Update

Published 2015-05-12 · Updated 2016-12-03 · CVE-2015-2233

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034

Description The issue arises from improper validation of CA chains during signature validation, allowing man-in-the-middle attackers to upload and execute arbitrary files using a crafted certificate.

Recommendations For versions prior to 5.06.0034, update to version 5.06.0034 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2015-2233

Affected Products

Lenovo System Update

References · 5

• http://support.lenovo.com/us/en/product_security/lsu_privilege · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2233 · Security Note
• http://securitytracker.com/id/1032268 · Note
• http://ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf · Note
• http://securityfocus.com/bid/74642 · Note