Privilege Escalation Vulnerabilities within Lenovo Solution Center

Privilege Escalation Vulnerabilities within Lenovo Solution Center

Privilege Escalation Vulnerabilities within Lenovo Solution Center

Lenovo Security Advisory: LEN-4326
Potential Impact: Escalation of privileges
Severity: High

Summary:

Vulnerabilities were discovered in the Lenovo Solution Center (LSC) software which could allow a remote attacker or local user to execute arbitrary code with SYSTEM privileges. We urgently completed an assessment of this issue and prepared and tested fixes that eliminate these vulnerabilities.  These updates are now posted and available for download through various update channels described in the mitigation strategy below.


Description:

The Lenovo Solution Center (LSC) is a software application created by Lenovo that allows users to perform diagnostic functions and quickly identify the status of PC system hardware and software health, network connections and the presence of security features such as firewalls or antivirus programs.

LSC consists of two components – a frontend user interface and a backend service process. The backend service process, LSCTaskService may be running on a user’s computer even if the frontend user interface is not.

Vulnerabilities were identified within LSC’s backend service process that may allow a local user to execute arbitrary code with SYSTEM level privileges.

In addition, a cross-site request forgery (CSRF) vulnerability exists that may allow exploitation of these vulnerabilities if a user opens a malicious  web site or crafted URL while the LSC backend service is running on a user’s machine.  The user’s computer may still be vulnerable even if the LSC user interface is not running.

UPDATE 4/25/2016: Additional security fixes for a local privilege escalation vulnerability (CVE-2016-1876) were released in Lenovo Solution Center version 3.3.002

Mitigation Strategy for Customers (how to eliminate these vulnerabilities):

Lenovo has released an updated version of Lenovo Solution Center that addresses these vulnerabilities. Lenovo is providing this update through several channels to ensure that as many users as possible get the update as described below:  

1) Updating via Lenovo Solution Center:

Users should open Lenovo Solution Center and they will be presented with a prompt to automatically update LSC to the latest version. Depending on the version of Lenovo Solution Center installed, select either “Yes” or “Update Now” when presented with the prompt, as illustrated below.

Version 2.x.x:

len4326_01

Version 3.x.x:

len4326_02

2) Updating via the Lenovo System Update utility

Open Lenovo System Update and click Next to Get new updates.  Follow the prompts to update your system with the latest version of Lenovo Solution Center.

3) Updating via direct download

Click on the download link from the following website. Follow the instructions in the readme file to install the update manually:
https://support.lenovo.com/lenovodiagnosticsolutions/tools/lscoverview

 

Product Impact:

Versions earlier than 3.3.0002 of Lenovo Solution Center may be impacted by these vulnerabilities.

Acknowledgements:

Thanks to Martin Rakhmanov of Trustwave's SpiderLabs (CVE-2016-1876)

Other information and references:

CVE-2015-8534, CVE-2015-8535, CVE-2015-8536, CVE-2016-1876

Revision History:

Revision

Date

Description

 3.1  11 May 2016  Added update paths to version 3.3.002 through Lenovo System Update and direct download
 3.0  26 April 2016  Released new version 3.3.002 with additional security fixes
 2.1  13 Jan 2016  Added information about how to update via Lenovo System Update and Lenovo OneKey Optimizer
 2.0  11 Dec 2015  Updated advisory with LSC fix version information
 1.1  9 Dec 2015  Updated mitigation strategy for customers
 1.0  3 Dec 2015  Initial release

Alias Id:LEN_4326
Document ID:PS500024
Original Publish Date:06/16/2016
Last Modified Date:06/20/2016