Description
Heap-based buffer overflow in the tvtumin.sys kernel driver in Lenovo Rescue and Recovery 4.20, including 4.20.0511 and 4.20.0512, allows local users to execute arbitrary code via a long file name.
References
- 20081010 iSEC Partners Security Advisory - 2008-002-lenovornr - Lenovo Rescue and Recovery 4.20 mailing-list
- 32252 third-party-advisory
- 4421 third-party-advisory
- http://www-307.ibm.com/pc/support/site.wss/MIGR-70699.html
- http://www.isecpartners.com/advisories/2008-02-lenovornr.txt
- http://www-307.ibm.com/pc/support/site.wss/MIGR-4Q2QAK.html
- ADV-2008-2806 vdb-entry
- 1021041 vdb-entry
- lenovo-rescue-recovery-tvtumin-bo(45839) vdb-entry
- 31737 vdb-entry