KLA10821 Arbitrary code execution vulnerability in Lenovo Accelerator Application

Improper implementation of update mechanism was found in Lenovo Accelerator Application. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via spoofing an update response by man-in-the-middle attack.

Technical details

To workaround this vulnerability you have to uninstall Lenovo Accelerator Application. For further instructions you can read original LEN-6718 Lenovo advisory listed below.

Original advisories

Original advisory

Related products

Lenovo-Accelerator-Application

CVE list

CVE-2016-3944 critical

Solution

Uninstall Lenovo Accelerator Application

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Affected Products

• Lenovo Accelerator Application all versions