Lenovo System Update CVE-2015-8109 Local Privilege Escalation Vulnerability

Bugtraq ID:	98039
Class:	Design Error
CVE:	CVE-2015-8109
Remote:	No
Local:	Yes
Published:	Apr 14 2017 12:00AM
Updated:	May 02 2017 12:10AM
Credit:	Sofiane Talmat of IOActive
Vulnerable:	Lenovo System Update 5.6.34 Lenovo System Update 3.14 Lenovo System Update 3
Not Vulnerable:	Lenovo System Update 5.7.19

Lenovo System Update CVE-2015-8109 Local Privilege Escalation Vulnerability

Lenovo System Update is prone to a local privilege-escalation vulnerability.

A local attacker can exploit this vulnerability to gain Administrator or SYSTEM level privileges.

Versions prior to Lenovo System Update 5.07.0019 are vulnerable.

Lenovo System Update CVE-2015-8109 Local Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Lenovo System Update CVE-2015-8109 Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Lenovo System Update CVE-2015-8109 Local Privilege Escalation Vulnerability

References:

• LEN-2015-011: Lenovo System Update Privilege Escalation (Lenovo)
  
• Lenovo Homepage (IBM)
  
• Lenovo System Update (ioactive)