PT-2015-5677 · Lenovo · Lenovo System Update

Published 2015-05-12 · Updated 2017-01-03 · CVE-2015-2234

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034

Description A race condition issue exists due to world-writable permissions for the update files directory. This allows local users to gain privileges by writing to an update file after the signature is validated.

Recommendations For versions prior to 5.06.0034, update to version 5.06.0034 or later to resolve the issue.

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2015-2234

Affected Products

Lenovo System Update

References · 5

• http://support.lenovo.com/us/en/product_security/lsu_privilege · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-2234 · Security Note
• http://securityfocus.com/bid/74634 · Note
• http://securitytracker.com/id/1032268 · Note
• http://ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf · Note