2445 matches found
Design/Logic Flaw
Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...
Design/Logic Flaw
Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service SUService.exe through an unspecified named pipe...
Race condition
Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...
CVE-2015-2233
Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...
CVE-2015-2219
Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service SUService.exe through an unspecified named pipe...
CVE-2015-2233
Lenovo System Update (before 5.06.0034) is affected by CVE-2015-2233 due to improper validation of CA chains during signature validation. This allows a man-in-the-middle with a crafted certificate to upload and execute arbitrary files. Affected software is Lenovo System Update prior to 5.06.0034,...
CVE-2015-2219
Lenovo System Update (before 5.06.0034) contains a local privilege escalation due to predictable security tokens used to access the System Update named pipe SUservice.exe. The named pipe, \SUPipeServer, can be interacted with by normal users to inject commands as SYSTEM if a valid token is provid...
CVE-2015-2234
CVE-2015-2234 affects Lenovo System Update (versions prior to 5.06.0034). The issue is a race/permission problem where the update files directory is world-writable, allowing a local attacker to replace an update file after signature validation and potentially escalate privileges. The Nessus/Kasp...
CVE-2015-2234
Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...
PT-2015-5676
Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description The issue arises from improper validation of CA chains during signature validation, allowing man-in-the-middle attackers to upload and execute arbitrary files using a crafted...
PT-2015-5677
Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description A race condition issue exists due to world-writable permissions for the update files directory. This allows local users to gain privileges by writing to an update file after the...
PT-2015-5671
Name of the Vulnerable Software and Affected Versions Lenovo System Update versions prior to 5.06.0034 Description The issue allows local users to gain privileges by sending a valid token with a command to the System Update service through an unspecified named pipe, due to the use of predictable...
CVE-2015-2233: Undefined Security Weakness
Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...
CVE-2015-2219: Undefined Security Weakness
Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service SUService.exe through an unspecified named pipe...
CVE-2015-2234: Concurrent Execution using Shared Resource with Improper Synchronization
Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...
[USN-2597-2] Linux kernel (Trusty HWE) regression
========================================================================== Ubuntu Security Notice USN-2597-2 May 08, 2015 linux-lts-trusty regression ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: -...
Lenovo ThinkPad series computers was traced to multiple security vulnerabilities-vulnerability warning-the black bar safety net
Recently, security firm IOActive at the Lenovo Series of computers found a security vulnerability, the attacker may be on the computers of legitimate applications replaced with malicious app and you can remotely execute malicious instructions. IOActive security researcher in the Bulletin elaborat...
Lenovo System Update Download File Replacement Vulnerability
Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update system downloads application updates to a writable directory, allowing local users to replace downloaded files and elevate permissions...
Lenovo System Update Correct Checksum Bypass Vulnerability
Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update fails to properly validate the Lenovo System Update CA certificate chain, allowing remote attackers who can conduct man-in-the-middle attacks to bypass signature validation, replace Lenovo applications, and execute...
Lenovo System Update Security Token Predicts Arbitrary Code Execution Vulnerability
Lenovo System Update is a system upgrade tool for Lenovo. Lenovo System Update uses predictable security tokens to access the update mechanism, allowing local users to guess security tokens, provide tokens to the system upgrade service, and execute arbitrary commands...