Unscored severity · published May 12, 2015
CVE-2015-2234
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local…
–
CVSS
0.3%
EPSS
No
On KEV
Description
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
System Update · Lenovo
through 5.06.0027 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2234
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2234
securitytracker.com
http://securitytracker.com/id/1032268
Vendor Advisory
http://support.lenovo.com/us/en/product_security/lsu_privilege
www.ioactive.com
http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf
www.securityfocus.com
http://www.securityfocus.com/bid/74634
More from System Update
7.8
CVE-2023-4632
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges
7.8
CVE-2022-0354
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during…
7.8
CVE-2015-7334
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA
7.8
CVE-2015-7333
MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA
7.8
CVE-2018-9063
MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very…