KLA10572 Multiple vulnerabilities in Lenovo System Update

Multiple serious vulnerabilities have been found in Lenovo System Update. Malicious users can exploit these vulnerabilities to bypass security restrictions or gain privileges.

Below is a complete list of vulnerabilities

1. Lack of command piping restrictions can be exploited locally via named pipe manipulations;
2. Lack of file signatures verification can be exploited remotely via a specially designed executable files;
3. Lack of directory permissions restrictions can be exploited locally via a files manipulations.

Original advisories

IOActive advisory

Lenovo advisory

Related products

Lenovo-System-Update

CVE list

CVE-2015-2234 high

CVE-2015-2233 critical

CVE-2015-2219 high

Solution

Update to the latest version

Get Lenovo System Update

Impacts

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Lenovo System Update versions earlier than 5.06.0034