Privilege escalation in Lenovo System Update

Published: 2018-05-16 16:18:50
Severity Low
Patch available YES
Number of vulnerabilities 1
CVE ID CVE-2018-9063
CVSSv3 7.7 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CWE ID CWE-120
Exploitation vector Local
Public exploit Not available
Vulnerable software Lenovo System Update
Vulnerable software versions Lenovo System Update 5.07.0070
Lenovo System Update 5.07.0045
Lenovo System Update 5.07.0032
Show more
Vendor URL Lenovo

Security Advisory

1) Buffer overflow

Description

The vulnerability allows a local attacker to gain elevated privivleges on the target system.

The weakness exists in MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) due to buffer overflow. A local attacker entering very large user ID or password can overrun the program's buffer and execute arbitrary code with root privileges.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Update to version 5.07.0072 or later.

External links

https://support.lenovo.com/ua/ru/solutions/len-19625

Back to List