Lenovo System Update Local Elevation of Privilege (CVE-2015-2234)

Lenovo System Update Local Elevation of Privilege (CVE-2015-2234)
Lenovo System Update Local Elevation of Privilege (CVE-2015-2234)

Release date:
Updated on:

Affected Systems:

Lenovo System Update <= 5.6.0.27

Description:

CVE (CAN) ID: CVE-2015-2234

Lenovo System Update is a member of the ThinkVantage software family for automatic updates to the ThinkPad System, including device drivers and Windows System patches.

Lenovo System Update 5.6.0.27 and earlier versions save executable files in Writable Directories, forming a race condition between signature verification and execution of saved files. Local Users exploit this vulnerability to improve executable permissions.

<* Source: IOActive

Link: http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
*>

Suggestion:

Vendor patch:

Lenovo
------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.lenovo.com/ca/en/

This article permanently updates the link address: