Privilege Escalation Vulnerabilities within Lenovo Solution Center
Privilege Escalation Vulnerabilities within Lenovo Solution Center
Privilege Escalation Vulnerabilities within Lenovo Solution Center
Lenovo Security Advisory: LEN-4326
Potential Impact: Escalation of privileges
Severity: High
Summary:
Vulnerabilities were discovered in the Lenovo Solution Center (LSC) software which could allow a remote attacker or local user to execute arbitrary code with SYSTEM privileges. We urgently completed an assessment of this issue and prepared and tested fixes that eliminate these vulnerabilities. These updates are now posted and available for download through various update channels described in the mitigation strategy below.
Description:
The Lenovo Solution Center (LSC) is a software application created by Lenovo that allows users to perform diagnostic functions and quickly identify the status of PC system hardware and software health, network connections and the presence of security features such as firewalls or antivirus programs.
LSC consists of two components – a frontend user interface and a backend service process. The backend service process, LSCTaskService may be running on a user’s computer even if the frontend user interface is not.
Vulnerabilities were identified within LSC’s backend service process that may allow a local user to execute arbitrary code with SYSTEM level privileges.
In addition, a cross-site request forgery (CSRF) vulnerability exists that may allow exploitation of these vulnerabilities if a user opens a malicious web site or crafted URL while the LSC backend service is running on a user’s machine. The user’s computer may still be vulnerable even if the LSC user interface is not running.
UPDATE 4/25/2016: Additional security fixes for a local privilege escalation vulnerability (CVE-2016-1876) were released in Lenovo Solution Center version 3.3.002
Mitigation Strategy for Customers (how to eliminate these vulnerabilities):
Lenovo has released an updated version of Lenovo Solution Center that addresses these vulnerabilities. Lenovo is providing this update through several channels to ensure that as many users as possible get the update as described below:
1) Updating via Lenovo Solution Center:
Users should open Lenovo Solution Center and they will be presented with a prompt to automatically update LSC to the latest version. Depending on the version of Lenovo Solution Center installed, select either “Yes” or “Update Now” when presented with the prompt, as illustrated below.
Version 2.x.x:
Version 3.x.x:
2) Updating via the Lenovo System Update utility
Open Lenovo System Update and click Next to Get new updates. Follow the prompts to update your system with the latest version of Lenovo Solution Center.
3) Updating via direct download
Click on the download link from the following website. Follow the instructions in the readme file to install the update manually:
https://support.lenovo.com/lenovodiagnosticsolutions/tools/lscoverview
Product Impact:
Versions earlier than 3.3.0002 of Lenovo Solution Center may be impacted by these vulnerabilities.Acknowledgements:
Thanks to Martin Rakhmanov of Trustwave's SpiderLabs (CVE-2016-1876)Other information and references:
CVE-2015-8534, CVE-2015-8535, CVE-2015-8536, CVE-2016-1876Revision History:
Revision |
Date |
Description |
3.1 | 11 May 2016 | Added update paths to version 3.3.002 through Lenovo System Update and direct download |
3.0 | 26 April 2016 | Released new version 3.3.002 with additional security fixes |
2.1 | 13 Jan 2016 | Added information about how to update via Lenovo System Update and Lenovo OneKey Optimizer |
2.0 | 11 Dec 2015 | Updated advisory with LSC fix version information |
1.1 | 9 Dec 2015 | Updated mitigation strategy for customers |
1.0 | 3 Dec 2015 | Initial release |
Your feedback helps to improve the overall experience