Details of VAR-202003-1194

ID

VAR-202003-1194

CVE

CVE-2015-5684

TITLE

Lenovo Service Engine Classic buffer overflow vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2015-008633

DESCRIPTION

MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A buffer overflow vulnerability was reported, (fixed and publicly disclosed in 2015) in the Lenovo Service Engine (LSE), affecting various versions of BIOS for Lenovo Notebooks, that could allow a remote user to execute arbitrary code on the system. Lenovo Service Engine (LSE) Exists in a classic buffer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Multiple products are prone to a remote code-execution vulnerability. An attacker can exploit this issue to execute arbitrary code in the context of an affected system. Failed exploit attempts may result in a denial-of-service condition

Trust: 1.98

sources: NVD: CVE-2015-5684 // JVNDB: JVNDB-2015-008633 // BID: 76416 // VULMON: CVE-2015-5684

AFFECTED PRODUCTS

vendor:	lenovo	model:	g40-80	scope:	lt	version:	b0cn75ww	Trust: 1.0
vendor:	lenovo	model:	g50-80 touch v3000	scope:	lt	version:	b0cn75ww	Trust: 1.0
vendor:	lenovo	model:	flex 2 pro-15	scope:	lt	version:	b9cn17ww	Trust: 1.0
vendor:	lenovo	model:	flex 3-1120	scope:	lt	version:	c0cn25ww	Trust: 1.0
vendor:	lenovo	model:	z41-70	scope:	lt	version:	c2cn18ww\(v1.04\)	Trust: 1.0
vendor:	lenovo	model:	ideapad 100-15iby	scope:	lt	version:	v1.02_\(cccn13ww\)	Trust: 1.0
vendor:	lenovo	model:	m40-35	scope:	lt	version:	bbcn15ww\(v1.06\)	Trust: 1.0
vendor:	lenovo	model:	g50-80 touch	scope:	lt	version:	b0cn75ww	Trust: 1.0
vendor:	lenovo	model:	flex 3-1570	scope:	lt	version:	bdcn30ww	Trust: 1.0
vendor:	lenovo	model:	yoga 3 14	scope:	lt	version:	bacn33ww	Trust: 1.0
vendor:	lenovo	model:	s435	scope:	lt	version:	bbcn15ww\(v1.06\)	Trust: 1.0
vendor:	lenovo	model:	ideapad 100-14iby	scope:	lt	version:	v1.02_\(cccn13ww\)	Trust: 1.0
vendor:	lenovo	model:	flex 2 pro-15	scope:	lt	version:	a9cn46ww	Trust: 1.0
vendor:	lenovo	model:	edge 15	scope:	lt	version:	b9cn17ww	Trust: 1.0
vendor:	lenovo	model:	g50-80m	scope:	lt	version:	cbcn75ww	Trust: 1.0
vendor:	lenovo	model:	g40-80m	scope:	lt	version:	cbcn75ww	Trust: 1.0
vendor:	lenovo	model:	flex 3-1470	scope:	lt	version:	bdcn30ww	Trust: 1.0
vendor:	lenovo	model:	y40-80	scope:	lt	version:	b5cn36ww\(v2.02\)	Trust: 1.0
vendor:	lenovo	model:	u41-70	scope:	lt	version:	bdcn30ww	Trust: 1.0
vendor:	lenovo	model:	g50-80	scope:	lt	version:	b0cn75ww	Trust: 1.0
vendor:	lenovo	model:	s41-70	scope:	lt	version:	bdcn30ww	Trust: 1.0
vendor:	lenovo	model:	s21e	scope:	lt	version:	c4cn14ww\(v1.04\)	Trust: 1.0
vendor:	lenovo	model:	g70-80	scope:	lt	version:	abcn75ww	Trust: 1.0
vendor:	lenovo	model:	edge 15	scope:	lt	version:	a9cn46ww	Trust: 1.0
vendor:	lenovo	model:	u31-70	scope:	lt	version:	afcn30ww\(v2.02\)	Trust: 1.0
vendor:	lenovo	model:	z51-70	scope:	lt	version:	c2cn18ww\(v1.04\)	Trust: 1.0
vendor:	lenovo	model:	z70-80	scope:	lt	version:	abcn75ww	Trust: 1.0
vendor:	lenovo	model:	yoga 3 11	scope:	lt	version:	b8cn30ww\(v2.08\)	Trust: 1.0
vendor:	lenovo	model:	b50-10	scope:	lt	version:	cccn13ww\(v1.02\)	Trust: 1.0
vendor:	lenovo	model:	b50-10	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	edge 15	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	flex 2 pro-15	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	flex 3-1120	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	flex 3-1470	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	flex 3-1570	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	g40-80	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	g50-80 touch v3000	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	g50-80 touch	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	g50-80	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	flex pro-15	scope:	eq	version:	20	Trust: 0.6
vendor:	lenovo	model:	edge	scope:	eq	version:	150	Trust: 0.6
vendor:	lenovo	model:	z70-80	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	z51-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	z50-75	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	z50-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	z41-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	z40-75	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	z40-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yt s4040	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yt s4030	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yt s4005	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yt s2000	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yt m2620n	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yt a7700k	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yoga3	scope:	eq	version:	140	Trust: 0.3
vendor:	lenovo	model:	yoga2pro-13	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	yoga	scope:	eq	version:	3110	Trust: 0.3
vendor:	lenovo	model:	y50-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	y430p	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	y40-80	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	y40-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	x315	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	x310	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	-	scope:	eq	version:	v30000	Trust: 0.3
vendor:	lenovo	model:	u430touch	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	u430p	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	u41-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	u330touch	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	u330p	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	service engine	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s435	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s415	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s410	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s41-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s40-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s310	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s21e	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s20-30 touch	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	s20-30	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	m7100n	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	m5790n	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	m5310n	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	m40-35	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	horizon2	scope:	eq	version:	270	Trust: 0.3
vendor:	lenovo	model:	horizon 2s	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	h5055	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	h5050	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	h5000	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	h3050	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	h3000	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g70-80	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g510	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g5055	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g5050	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g5000	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g50-80	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g50-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g50-45	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g50-30	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g410	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g40-80	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g40-70	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g40-45	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	g40-30	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	flex2	scope:	eq	version:	150	Trust: 0.3
vendor:	lenovo	model:	flex2	scope:	eq	version:	140	Trust: 0.3
vendor:	lenovo	model:	flex	scope:	eq	version:	3-15700	Trust: 0.3
vendor:	lenovo	model:	flex	scope:	eq	version:	3-14700	Trust: 0.3
vendor:	lenovo	model:	flex	scope:	eq	version:	3-11200	Trust: 0.3
vendor:	lenovo	model:	flex	scope:	eq	version:	100	Trust: 0.3
vendor:	lenovo	model:	f5055	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	f5050	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	f5000	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	edge	scope:	eq	version:	71	Trust: 0.3
vendor:	lenovo	model:	e10-30	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	d5055	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	d5050	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	d3000	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	c5030	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	c4030	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	c4005	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	c260	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	c2030	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	c2005	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	b750	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	b5035	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	b5030	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	b4030	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	a740	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	a5700k	scope:	eq	version:	0	Trust: 0.3
vendor:	lenovo	model:	a540	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	workstations z82	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	workstations z620	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	workstations z420	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	workstations z220	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	workstations z1	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	probook s	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	probook m	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	probook b	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	elitebook p series	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	elitebook 8770w	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	elitebook 8570w	scope:	eq	version:	0	Trust: 0.3
vendor:	hp	model:	compaq elite series	scope:	eq	version:	83000	Trust: 0.3
vendor:	hp	model:	compaq pro series	scope:	eq	version:	63050	Trust: 0.3
vendor:	hp	model:	compaq	scope:	eq	version:	63000	Trust: 0.3

sources: BID: 76416 // JVNDB: JVNDB-2015-008633 // NVD: CVE-2015-5684

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2015-5684
value:	CRITICAL
Trust: 1.0
NVD:	JVNDB-2015-008633
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201512-682
value:	CRITICAL
Trust: 0.6
VULMON:	CVE-2015-5684
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2015-5684
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.1
NVD:	JVNDB-2015-008633
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8

nvd@nist.gov:	CVE-2015-5684
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2015-008633
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULMON: CVE-2015-5684 // JVNDB: JVNDB-2015-008633 // CNNVD: CNNVD-201512-682 // NVD: CVE-2015-5684

PROBLEMTYPE DATA

problemtype:

CWE-120

Trust: 1.8

sources: JVNDB: JVNDB-2015-008633 // NVD: CVE-2015-5684

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201512-682

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201512-682

CONFIGURATIONS

sources: JVNDB: JVNDB-2015-008633

PATCH

title:	LEN-2015-020	url:	https://support.lenovo.com/us/en/product_security/lse_bios_notebook	Trust: 0.8
title:	Lenovo Service Engine Buffer error vulnerability fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=113086	Trust: 0.6

sources: JVNDB: JVNDB-2015-008633 // CNNVD: CNNVD-201512-682

EXTERNAL IDS

db:	NVD	id:	CVE-2015-5684	Trust: 2.8
db:	JVNDB	id:	JVNDB-2015-008633	Trust: 0.8
db:	CNNVD	id:	CNNVD-201512-682	Trust: 0.6
db:	BID	id:	76416	Trust: 0.4
db:	VULMON	id:	CVE-2015-5684	Trust: 0.1

sources: VULMON: CVE-2015-5684 // BID: 76416 // JVNDB: JVNDB-2015-008633 // CNNVD: CNNVD-201512-682 // NVD: CVE-2015-5684

REFERENCES

url:	https://support.lenovo.com/us/en/product_security/lse_bios_notebook	Trust: 2.0
url:	https://nvd.nist.gov/vuln/detail/cve-2015-5684	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-5684	Trust: 0.8
url:	http://seclists.org/bugtraq/2015/aug/44	Trust: 0.3
url:	https://support.lenovo.com/us/en/product_security/lse_bios_desktop	Trust: 0.3
url:	http://h10032.www1.hp.com/ctg/manual/c03857419.pdf	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/120.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://www.securityfocus.com/bid/76416	Trust: 0.1

sources: VULMON: CVE-2015-5684 // BID: 76416 // JVNDB: JVNDB-2015-008633 // CNNVD: CNNVD-201512-682 // NVD: CVE-2015-5684

CREDITS

Roel Schouwenberg and Microsoft

Trust: 0.9

sources: BID: 76416 // CNNVD: CNNVD-201512-682

SOURCES

db:	VULMON	id:	CVE-2015-5684
db:	BID	id:	76416
db:	JVNDB	id:	JVNDB-2015-008633
db:	CNNVD	id:	CNNVD-201512-682
db:	NVD	id:	CVE-2015-5684

LAST UPDATE DATE

2024-11-23T22:21:14.882000+00:00

SOURCES UPDATE DATE

db:	VULMON	id:	CVE-2015-5684	date:	2020-04-01T00:00:00
db:	BID	id:	76416	date:	2015-07-31T00:00:00
db:	JVNDB	id:	JVNDB-2015-008633	date:	2020-04-17T00:00:00
db:	CNNVD	id:	CNNVD-201512-682	date:	2020-04-03T00:00:00
db:	NVD	id:	CVE-2015-5684	date:	2024-11-21T02:33:37.920

SOURCES RELEASE DATE

db:	VULMON	id:	CVE-2015-5684	date:	2020-03-27T00:00:00
db:	BID	id:	76416	date:	2015-07-31T00:00:00
db:	JVNDB	id:	JVNDB-2015-008633	date:	2020-04-17T00:00:00
db:	CNNVD	id:	CNNVD-201512-682	date:	2015-07-31T00:00:00
db:	NVD	id:	CVE-2015-5684	date:	2020-03-27T15:15:11.507