CVE-2015-2219: High severity Lenovo System Update vulnerability
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service (SUService.exe) through an unspecified named pipe.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Lenovo System Updateto a version that resolves this vulnerability.Fixed in 5.06.0034
Event History
Frequently Asked Questions
What is the severity of CVE-2015-2219?
CVE-2015-2219 has been assigned a medium severity rating due to its potential for privilege escalation.
How do I fix CVE-2015-2219?
To fix CVE-2015-2219, upgrade Lenovo System Update to version 5.06.0034 or later.
Who is affected by CVE-2015-2219?
Local users of Lenovo System Update versions prior to 5.06.0034 are affected by CVE-2015-2219.
What causes CVE-2015-2219?
CVE-2015-2219 is caused by the use of predictable security tokens in Lenovo System Update.
What systems are vulnerable to CVE-2015-2219?
All versions of Lenovo System Update before 5.06.0034 are vulnerable to CVE-2015-2219.