CVE-2018-9063

MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv.

CVSS v3 7.8 HIGH
CVSS v2.0 4.6 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector : AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/104125	Third Party Advisory VDB Entry
https://support.lenovo.com/us/en/solutions/LEN-19625	Vendor Advisory
http://www.securityfocus.com/bid/104125	Third Party Advisory VDB Entry
https://support.lenovo.com/us/en/solutions/LEN-19625	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:14

Type	Values Removed	Values Added
References	~~() http://www.securityfocus.com/bid/104125 - Third Party Advisory, VDB Entry~~	() http://www.securityfocus.com/bid/104125 - Third Party Advisory, VDB Entry
References	~~() https://support.lenovo.com/us/en/solutions/LEN-19625 - Vendor Advisory~~	() https://support.lenovo.com/us/en/solutions/LEN-19625 - Vendor Advisory

Information

Published : 2018-05-04 17:29

Updated : 2024-11-21 04:14

NVD link : CVE-2018-9063

Mitre link : CVE-2018-9063

CVE.ORG link : CVE-2018-9063

JSON object : View

Products Affected

lenovo

system_update

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2018-9063", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2018-05-04T17:29:00.770", "references": [{"url": "http://www.securityfocus.com/bid/104125", "tags": ["Third Party Advisory", "VDB Entry"], "source": "psirt@lenovo.com"}, {"url": "https://support.lenovo.com/us/en/solutions/LEN-19625", "tags": ["Vendor Advisory"], "source": "psirt@lenovo.com"}, {"url": "http://www.securityfocus.com/bid/104125", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.lenovo.com/us/en/solutions/LEN-19625", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "MapDrv (C:\\Program Files\\Lenovo\\System Update\\mapdrv.exe) In Lenovo System Update versions earlier than 5.07.0072 contains a local vulnerability where an attacker entering very large user ID or password can overrun the program's buffer, causing undefined behaviors, such as execution of arbitrary code. No additional privilege is granted to the attacker beyond what is already possessed to run MapDrv."}, {"lang": "es", "value": "MapDrv (C:\\Program Files\\Lenovo\\System Update\\mapdrv.exe) en Lenovo System Update, en versiones anteriores a la 5.07.0072, contiene una vulnerabilidad local en la que un atacant que introduzca un ID de usuario o una contrase\u00f1a muy largas puede desbordar el b\u00fafer del programa, provocando comportamientos indefinidos como la ejecuci\u00f3n de c\u00f3digo arbitrario. No se otorgan m\u00e1s privilegios al atacante m\u00e1s all\u00e1 de los que ya se poseen para ejecutar MapDrv."}], "lastModified": "2024-11-21T04:14:53.817", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lenovo:system_update:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F65FD54-263E-49DD-B6E9-362F33B85C8A", "versionEndExcluding": "5.07.0072"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@lenovo.com"}