ThinkVantage System Update < 3.14 SSL Certificate Issuer Spoofing

This script is Copyright (C) 2008-2016 Tenable Network Security, Inc.


Synopsis :

A remote Windows host contains a program that is prone to a spoofing
attack.

Description :

The remote host is running ThinkVantage System Update, a software
distribution tool for Lenovo computers.

The version of System Update installed on the remote host reportedly
does not perform certificate chain verification when initiating an SSL
connection with an update server. An attacker who could redirect
connections to a malicious server could leverage this issue to send
specially crafted XML and EXE files in response to requests from
System Update, which would then lead to arbitrary code execution.

See also :

http://www.security-objectives.com/advisories/SECOBJADV-2008-01.txt
http://seclists.org/bugtraq/2008/May/283
http://www.nessus.org/u?1bcf51b5

Solution :

Upgrade to System Update 3.14 or later.

Risk factor :

High / CVSS Base Score : 7.6
(CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C)
CVSS Temporal Score : 6.6
(CVSS2#E:ND/RL:OF/RC:ND)
Public Exploit Available : true

Family: Windows

Nessus Plugin ID: 32443 ()

Bugtraq ID: 29366

CVE ID: CVE-2008-3249

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now