Windows 8 and 8.1 Forums


Lenovo System Update Privilege Escalation

  1. #1



    Trying to Sith things out
    Bamberg Germany
    Posts : 2,288
    Windows 10 Pro 64 bit

    Lenovo System Update Privilege Escalation


    Lenovo Security Advisory: LEN-2015-011
    Potential Impact: Execution of arbitrary code
    Severity: Medium

    Summary:
    Multiple vulnerabilities have been identified within Lenovo System Update (previously known as ThinkVantage System Update). Lenovo has released a new version of the Lenovo System Update software that addresses these vulnerabilities.

    Description:
    Lenovo System Update validates all system update files as they are downloaded from the Lenovo servers. However, if the local system contains malware, it is possible that the downloaded updates could be altered before installation creating a race condition. The latest Lenovo System Update release eliminates this possibility. Lenovo System Update uses a service called SUService.exe to run system updates. As part of the authentication and validation process the service only accepts commands if a valid security token is passed along with the command. Vulnerabilities were discovered on how the security tokens were generated allowing an attacker to run commands. The latest Lenovo System Update release fixes the token authentication flaws.
    Other security issues were also addressed in this update.
    Mitigation Strategy for Customers (what you should do to protect yourself):
    Starting from April 1, 2015, run Lenovo System Update and install the latest version of the application, version 5.06.0034 or later. You can determine the currently installed version by opening Lenovo System Update, clicking on the green question mark in the top right corner and then selecting “About.”
    Steps to update:
    Lenovo System Update automatically checks for a later version whenever the application is run. Click OK when prompted that new version is available.
    To manually update, download the latest version from the following URL.

    Product Impact:
    The following products may be impacted:

    • All ThinkPad
    • All ThinkCentre
    • All ThinkStation
    • Lenovo V/B/K/E Series

    Acknowledgements:
    Lenovo would like to thank Michael Milvich and Sofiane Talmat of IOActive for reporting these issues.

    Other information and references:



    Source: https://support.lenovo.com/us/en/pro.../lsu_privilege

      My System SpecsSystem Spec

  2. #2



    Trying to Sith things out
    Bamberg Germany
    Posts : 2,288
    Windows 10 Pro 64 bit


    Bundleware/ Crapware: This is why I do a clean install on a brand new PC.
      My System SpecsSystem Spec

Lenovo System Update Privilege Escalation
Related Threads
Dear , i can't download any software so far.its says ( a requiered privilege is not held by the client ) am using windows 8.1 thank you for your support .
I click on the free win 8.1 update, it starts to down load and the % completed updates(gets larger), but when I walk away and look again, it is down to 10%, 19% never saw it larger than 78%. I clicked on install and the periods cycle left to right on the screen and it comes back with error not...
Lenovo laptop fails to restore system in Windows Updates & Activation
Hello eightforums, I have windows 8.1 on a lenovo laptop. A week ago there was an update and I installed it. But after that I first noticed that there was no sound. The volume control has always a red cross and I can't adjust it. Whenever I go to control panel the window freezes. Same goes...
Help can't change compatibility mode or privilege level in properties After apply settings when i open the applications its again back to normal http://www.win8forums.com/styles/default/xenforo/smilies/frown.png 47636 47637
So just few days ago i was playing with my laptop and it got really slow, I though it might be programs I've had opened or something but I just noticed something My fan doesn't seem to work when my CPU needs it, i used core-temp and the temperatures are at something like 80C and it feels much...
Windows 8.1 update crashes my Lenovo Yoga13 in Windows Updates & Activation
After updating to Windows 8.1, my PC is unable to restart with the following message displayed: 1) Preparing automatic repair 2) Diagnosing your PC 3) Your PC did not start correctly Here I am given 2 options: a) Restart b) Advanced Options.
Eight Forums Android App Eight Forums IOS App Follow us on Facebook