NVD

Id
24341  
Name
CVE-2015-2234  
Description
Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2015-05-12  
Modified Date
2017-01-02  
Seq
2015-2234  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
128840 24341 CVE-2015-2234 1032268  View
128841 24341 CVE-2015-2234 http://support.lenovo.com/us/en/product_security/lsu_privilege  View
128842 24341 CVE-2015-2234 http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf  View
128843 24341 CVE-2015-2234 74634  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
7354 JVNDB-2015-002674 Lenovo System Update における権限を取得される脆弱性 Lenovo System Update (旧 ThinkVantage System Update) は、競合状態により、ファイルのディレクトリのアップデートに誰でも書き込み可能な権限 (world-writable permission) を使用するため、権限を取得される脆弱性が存在します。 CVE-2015-2234 79459 CVE-2015-2234 24341 6.9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-002674.html 2015-04-14 2015-05-18 View