Buffer Overflow in Lenovo System Update Drive Mapping Utility - US

Lenovo Security Advisory: LEN-19625

**Potential Impact:**Buffer overflow resulting in undefined behaviors, such as execution of arbitrary code

Severity: Medium

Scope of Impact: Lenovo-specific

CVE Identifier: CVE-2018-9063

Summary Description:

MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) contains a local vulnerability where an attacker entering very large user ID or password can overrun the program’s buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.

Mitigation Strategy for Customers (what you should do to protect yourself):

Update Lenovo System Update to version 5.07.0072 or later. You can determine the currently installed version by opening Lenovo System Update, clicking on the green question mark in the top right corner and then selecting “About.”

Lenovo System Update can be updated by choosing either of the following methods:

1. Lenovo System Update automatically checks for a later version whenever the application is run. Click OK when prompted that a new version is available.
2. To manually update, download the latest version from the following URL: https://support.lenovo.com/en/documents/ht080136

Acknowledgement:

Lenovo thanks SaifAllah benMassaoud @benmassaou for reporting this issue.

References:

System Update Solution Deployment Guide: <https://download.lenovo.com/pccbbs/mobiles_pdf/tvsu5_mst_en.pdf&gt;

For a complete list of all Lenovo Product Security Advisories, click here.

Revision History:

Revision

|

Date

|

Description

—|—|—

1

|

2018-05-03

|

Initial release

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on as “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.