The flaws could allow attackers to execute malicious code with system privileges and to kill other processes Lenovo has fixed two high-severity vulnerabilities in the Lenovo Solution Center support tool that is preinstalled on many laptop and desktop PCs. The flaws could allow attackers to take over computers and terminate antivirus processes. Lenovo Solution Center (LSC) allows users to check their system’s virus and firewall status, update their Lenovo software, perform backups, check battery health, get registration and warranty information and run hardware tests. The two new vulnerabilities, tracked as CVE-2016-5249 and CVE-2016-5248 in the Common Vulnerabilities and Exposures database, were found by security researchers from Trustwave. They affect LSC versions 3.3.002 and earlier. The CVE-2016-5249 vulnerability allows an attacker who already has control of a limited account on a PC to execute malicious code via the privileged LocalSystem account. Privilege escalation flaws like this one cannot be used by themselves to compromise computers, but are often used in exploit chains. Due to security improvements in modern operating systems, remote code execution flaws don’t always provide attackers with full control over affected systems and need to be combined with privilege escalation vulnerabilities. Because of the functionality in the LSC.Services.SystemService component, any local user can open a communication pipe to the service and force it to execute arbitrary .NET code. Because this LSC service runs under the LocalSystem account, the rogue code would also be executed with LocalSystem privileges. The second vulnerability, CVE-2016-5248, allows any local user to send a command to LSC.Services.SystemService in order to kill any other process on the system, privileged or not. The target process could, for example, belong to an antivirus program or another security product. Lenovo advises users to upgrade to LSC version 3.3.003. This can be done from the application itself by agreeing to automatic update prompt, from the separate Lenovo System Update utility or by downloading the latest version of LSC manually. This is not the first time that serious flaws were found in LSC. However, Lenovo seems to be responding to such vulnerabilities in a timely manner by releasing patches and publishing security advisories. In a recent security analysis of the update tools preloaded on computers PC manufacturers, LSC was found to have one of the most secure implementations. Related content analysis At RSA, Cisco unveils Splunk integrations, Hypershield upgrades At RSA Conference 2024, Cisco announced plans to integrate its XDR platform and Splunk’s SIEM, bolster its Hypershield AI-native security architecture, and add to its Duo access-protection software. By Michael Cooney May 06, 2024 5 mins Network Management Software Network Security Networking how-to Download our Zero Trust network access (ZTNA) enterprise buyer’s guide From the editors of Network World, this enterprise buyer’s guide helps network and security IT staff understand what ZTNA can do for their organizations and how to choose the right solution. By Josh Fruhlinger and Steve Zurier May 06, 2024 1 min Network Security Enterprise Buyer’s Guides news Network jobs watch: Hiring, skills and certification trends What IT leaders need to know about expanding responsibilities, new titles and hot skills for network professionals and I&O teams. By Denise Dubie May 06, 2024 6 mins Careers Data Center Networking feature IBM’s bets on AI and hybrid cloud pay off Three key differentiators of IBM’s AI and cloud offerings are cross-platform automation, integration with multiple clouds, and tie-ins to IBM professional services. By Jeff Vance May 06, 2024 9 mins Hybrid Cloud Network Management Software Cloud Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe