high7.2Public exploit code
CVE-2015-2219
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by se…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Lenovo System Update - Local Privilege Escalation (Metasploit)2015-04-12 · local · windows · Verified
Impact
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | System Update | through 5.06.0027 |
Weakness classification
References
- NVD record
- CVE.org record
- http://securitytracker.com/id/1032268
- http://support.lenovo.com/us/en/product_security/lsu_privilege
- http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
- http://www.securityfocus.com/bid/74649
- http://securitytracker.com/id/1032268
- http://support.lenovo.com/us/en/product_security/lsu_privilege
- http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
- http://www.securityfocus.com/bid/74649