DLL Search Path and Symbolic Link Vulnerabilities
DLL Search Path and Symbolic Link Vulnerabilities
DLL Search Path and Symbolic Link Vulnerabilities
Lenovo Security Advisory: LEN-27431
Potential Impact: Privilege escalation
Severity: Medium
Scope of Impact: Lenovo-specific
CVE Identifier: CVE-2019-6173, CVE-2019-6196
Summary Description:
DLL search path and symbolic link vulnerabilities could allow privilege escalation in some Lenovo installation packages, prior to version 1.2.9.3, only during installation. Software already installed is not vulnerable to these issues.
CVE-2019-6173: A DLL search path vulnerability could allow privilege escalation in some Lenovo installation packages during installation if an attacker already has administrative privileges.
CVE-2019-6196: A symbolic link vulnerability in some Lenovo installation packages could allow privileged file operations during file extraction and installation.
.
Mitigation Strategy for Customers (what you should do to protect yourself):
NOTE: These vulnerabilities can only be leveraged during software installation. If you are not installing software, you are not impacted by this issue.
To mitigate these vulnerabilities, Lenovo recommends installing Lenovo software updates through Lenovo Vantage, Lenovo System Update, or Windows Update. Updates delivered through Update Retriever, Thin Installer, and System Update are also not affected. Lenovo installation packages version 1.2.9.3 or later are not affected. To verify package version, use these steps.
For system administrators who want to mitigate auto-update scripts they have built, the recommended steps to take can be found here.
As always, to prevent potential attackers from gaining administrative privileges, users are advised to protect themselves through good security practices such as updating anti-virus software, using only safe internet connections and not clicking on unknown links or web pages.
Acknowledgement:
Lenovo thanks Eran Shimony at CyberArk Labs for reporting this issue.
References:
Source code for installer patch: https://github.com/lenovoinc/issrc/tree/DLL_Injection_TempDir_fix
Revision History:
Revision | Date | Description |
---|---|---|
2 | 2020-06-09 | Added installation package version information |
1 | 2020-01-14 | Initial release |
For a complete list of all Lenovo Product Security Advisories, click here.
For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.
Your feedback helps to improve the overall experience