Slashdot Mirror
Lenovo Patches Serious Vulnerabilities In PC System Update Tool (csoonline.com)
itwbennett writes: "For the third time in less than six months security issues have forced Lenovo to update one of the tools preloaded on its PCs," writes Lucian Constantin. Last week, the company released version 5.07.0019 of Lenovo System Update, a tool that helps users keep their computers' drivers and BIOS up to date and which was previously called ThinkVantage System Update. The new version fixes two local privilege escalation vulnerabilities discovered by researchers from security firm IOActive.
So they patched the vulnerable tool that was supposed to fix vulnerabilities, and probably introduced some more vulnerabilities along the way. Bravo!
Dear Lenovo, please stop. Any more 'help' like this and you'll be the death of me.
Just cruising through this digital world at 33 1/3 rpm...
If Slashdot is going to report on every little bug that affects software that comes with Lenovo laptops, then Slashdot should also report on every bug that affects systemd, which comes with pretty much every single modern Linux installation.
Most of us here do not have Lenovo laptops, and never will. But most of us here do run Linux, and have been negatively affected by systemd. We find news about systemd's problems much more relevant than news about Lenovo's.
Time and time again these companies roll their own version of something, and time and time again it proves to be a failure.
Let the OS maker build the tools to manage the OS, this way when that is found to be defective we all get the same update.
This is one of the reasons I utterly hate OEM installs, because they put so much extra garbage on the machine as to render it almost useless.
My mother-in-law's laptop needed to have about a dozen or so "helpers" (ie shitware) disabled to make the machine usable, otherwise it was spending most of its time trying to see if it could be helpful and perform tasks which were already done.
Make a good quality laptop, and sell it to us. Make sure to write drivers for your stuff, and if you can't do that use someone's stuff which does have drivers.
And then leave the rest of the damned OS alone.
Just because someone in marketing wants to brand the experience and differentiate the product doesn't mean you're actually capable of delivering on this.
As often as not these "helpful" tools cause more problems than they could ever hope to fix.
Lost at C:>. Found at C.
Millions use Lenovo. 100:1 compared to your class. Does /. consume space only to cover what 99.999% have no interest in seeing? NO! NO!
Return to your master, slave!
> ThinkVantage
Makes me think the marketing people are robot phoning it in.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Shouldn't ALL of the updating be done through Windows update? Drivers and BIOS seems pretty important! Not only that but there are plenty of apps that have their own updating systems, that each run on their own schedule and trigger at different times and installs happen not all at once. How are you ever sure everything is completely up to date without checking in 20 different places?
Twinstiq, game news
Why? Because Windows is not UNIX and Microsoft is clueless about security.
I'm not sure that I want Windows update managing BIOS updates. Certainly not with the new "forced updates" system for all bar corporate clients that comes with Windows 10.
A BIOS update that goes wrong is something that can brick your system and require a hardware intervention to resolve. The idea of my PC doing one automatically while I'm out at work sends a cold shiver down my spine.
I'm generally unhappy about forced video-card update, as it's not unknown, in a world where Nvidia driver releases are timed and optimised for the latest big-name release, for new versions to cause sometimes-serious issues with older games or even OS-stability issues. But at least with a video card driver update, you can always, in the worst case, boot into safe mode and roll back (even on Win10 Pro, I can do this and then defer the update to the bad version for long enough that a new one supersedes it).
I'm religious about keeping my OS, drivers (barring the point on video card drivers above), browser and other programs up to date. But BIOS updates are something I do only if I absolutely have to in order to fix a specific problem. I don't want them rolling into Windows Update.
"For the third time in less than six months security issues have forced Lenovo to update one of the tools preloaded on its PCs"
You think this was a mistake. I figure a certain three letter agency is engaged in inserting back-doors on all the connected devices on the planet.
Lenovo has been on the shitstorm scene for a while, which is really sad given the excellent built of their thinkpad series. But regardless of that, I think the real culprit here is Microsoft. It is time for Microsoft to stop allowing OEM installs of their operating systems, if you want to put a windows computer out their, you do an MS install or none at all.
Does it matter? It's not like anyone with any awareness is going to buy their crap anyway. I avoid them like that plague now, and I advise everyone I know to do the same.
Maybe they can try again next Christmas?
*** *** You're just jealous 'cause the voices talk to me... ***
If you're a corporation surely you're not relying on Windows Update anyway? For end users, it should really not be something they have to think about. If video card manufacturers can't push out reliable updates that's another separate problem with QA. Yeah I agree about bios updates but I assume if Lenovo was willing to push one out to end users it must be critical?
Twinstiq, game news
That's like asking why isn't there a universal Android phone update tool. The answer is simple. Unless the manufacturer is the exclusive provider and chooses what hardware is offered, like Apple does, it's impossible to prevent third parties from using whatever hardware and drivers they want which makes centralized universal updates for hardware (and maybe the software too) impossible. Google has the same problem which is why the sell their "Nexus" line of phones for those who want a "pure" android software/hardware experience without third party nonsense and bloatware.
Considering I've seen Windows Update grab the wrong drivers, I actually don't like letting Windows do it itself. Not to mention how many users would get bricked with a BIOS update gone wrong.
At my last job, we did have a tool that pushed application updates (Flash player, vSphere client, etc) to everyone's computers along with Windows updates.
I'm starting to think GNU is the problem with "GNU/Linux" these days.