Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
Get access to immediate incident response assistance.
Get access to immediate incident response assistance.
Trustwave and Cybereason Merge to Form Global MDR Powerhouse for Unparalleled Cybersecurity Value. Learn More
After patching set of issues reported by Trustwave SpiderLabs last month, Lenovo released another version of its Lenovo Solution Center software to address new security holes. Specifically, we at Trustwave SpiderLabs found that the new version (3.3.002), even though significantly reworked, still allowed unprivileged users to elevate privileges to LocalSystem.
When an unprivileged user starts the LSC.Services.SystemService, it can pass arguments to the service. By design, this service expects three arguments which it interprets as named pipe name, mutex name and a process ID. The service permissions are set so that anyone can start and stop it.
When the service starts, it starts a small TCP server on a random port and uses the named pipe to send the server IP:PORT pair back. If an attacker prepares his own named pipe server and then starts the LSC.Services.SystemService, he will get TCP endpoint information to connect to.
It turns out that the TCP server provides several APIs, including one to load .NET assemblies from disk. Lenovo intended this API to load assemblies under the trusted path only. In reality it will load any .NET assembly on the same partition where the Lenovo Solution Center software is installed if a directory traversing pattern is used.
Considering the fact that the TCP server runs as LocalSystem account, attacker can load .NET assembly into a privileged process. This could be used to elevate privileges easily by referencing malicious assemblies placed in public folders which will execute code on loading for instance.
Trustwave SpiderLabs has worked closely with Lenovo to report and help address this issue. Thanks to Lenovo for their open communication and speedy response.
Please find complete proof-of-concept on SpiderLabs github site: https://github.com/SpiderLabs/advisories-poc/tree/master/cve-2016-5249
Please see our advisory for full details: https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18782
A new version of the software is available for download from Lenovo's site: https://support.lenovo.com/us/en/product_security/len_7814
Trustwave is a globally recognized cybersecurity leader that reduces cyber risk and fortifies organizations against disruptive and damaging cyber threats. Our comprehensive offensive and defensive cybersecurity portfolio detects what others cannot, responds with greater speed and effectiveness, optimizes client investment, and improves security resilience. Learn more about us.
Copyright © 2024 Trustwave Holdings, Inc. All rights reserved.