CVE-2015-2219
Lenovo System Update Privilege Escalation
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
Lenovo System Update (anteriormente ThinkVantage System Update) anterior a 5.06.0034 utiliza tokens de seguridad previsibles, lo que permite a usuarios locales ganar privilegios mediante el envío de un token válido con un comando al servicio System Update (SUService.exe) a través de una tubería nombrada (named pipe) no especificada.
The named pipe, \SUPipeServer, can be accessed by normal users to interact with the System update service. The service provides the possibility to execute arbitrary commands as SYSTEM if a valid security token is provided. This token can be generated by calling the GetSystemInfoData function in the DLL tvsutil.dll. Please, note that the System Update is stopped by default but can be started/stopped calling the Executable ConfigService.exe.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-03-05 CVE Reserved
- 2015-04-12 First Exploit
- 2015-05-12 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://securitytracker.com/id/1032268 | Vdb Entry | |
| http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf | X_refsource_misc | |
| http://www.securityfocus.com/bid/74649 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/41708 | 2015-04-12 | |
| https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/local/lenovo_systemupdate.rb | 2015-04-12 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://support.lenovo.com/us/en/product_security/lsu_privilege | 2016-12-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Lenovo Search vendor "Lenovo" | System Update Search vendor "Lenovo" for product "System Update" | <= 5.06.0027 Search vendor "Lenovo" for product "System Update" and version " <= 5.06.0027" | - |
Affected
| ||||||