CVE-2015-2233: High severity lenovo system update vulnerability
Published May 12, 2015
·Updated
Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate.
Affected Software
1 affected component
Lenovo System Update<=5.06.0027
Event History
May 12, 2015
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2015-2233?
CVE-2015-2233 has been assigned a medium severity level due to its potential for man-in-the-middle attacks.
2
How do I fix CVE-2015-2233?
To fix CVE-2015-2233, you should upgrade Lenovo System Update to version 5.06.0034 or later.
3
What types of attacks can CVE-2015-2233 enable?
CVE-2015-2233 can enable man-in-the-middle attacks that allow unauthorized file uploads and execution.
4
Which versions of Lenovo System Update are affected by CVE-2015-2233?
CVE-2015-2233 affects Lenovo System Update versions prior to 5.06.0034.
5
Is any user action required to mitigate the risk of CVE-2015-2233?
Yes, users must update their Lenovo System Update software to mitigate the risk associated with CVE-2015-2233.