CVE-2015-2234

{"id": "CVE-2015-2234", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-05-12T19:59:15.027", "references": [{"url": "http://securitytracker.com/id/1032268", "source": "cve@mitre.org"}, {"url": "http://support.lenovo.com/us/en/product_security/lsu_privilege", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/74634", "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id/1032268", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://support.lenovo.com/us/en/product_security/lsu_privilege", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ioactive.com/pdfs/Lenovo_System_Update_Multiple_Privilege_Escalations.pdf", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/74634", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Race condition in Lenovo System Update (formerly ThinkVantage System Update) before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated."}, {"lang": "es", "value": "Condici\u00f3n de carrera en Lenovo System Update (anteriormente ThinkVantage System Update) anterior a 5.06.0034 utiliza permisos de lectura universal para el directorio de los ficheros de actualizaciones, lo que permite usuarios locales ganar privilegios mediante la escritura de un fichero de actualizaci\u00f3n despu\u00e9s de que se valida la firma."}], "lastModified": "2024-11-21T02:27:02.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FB6E264B-E112-4CB5-8660-87C9D37CD4C9", "versionEndIncluding": "5.06.0027"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}