KLA10812 Privilege escalation vulnerabilities in Lenovo Solution Center

Multiple serious vulnerabilities have been found in Lenovo Solution Center. Malicious users can exploit these vulnerabilities to gain privileges.

Below is a complete list of vulnerabilities

1. An unknown vulnerability at SystemService can be exploited locally to terminate arbitrary process via StopProxy command;
2. An unknown vulnerability at SystemService can be exploited locally via StartProxy command to conduct execute arbitrary code with LocalSystem privileges.

Original advisories

Lenovo advisory

Related products

Lenovo-Solution-Center

CVE list

CVE-2016-5248 warning

CVE-2016-5249 high

Solution

Install update via Lenovo Solution Center, Lenovo System Update or manually. Instructions for update can be found at original advisory

Download update

Impacts

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Lenovo Solution Center versions earlier than 3.3.003