CMM Security Concerns - US

Lenovo Security Advisory: LEN-23806

**Potential Impact:**Information Disclosure; Hardcoded Encryption Key

Severity: Medium

Scope of Impact: Lenovo-specific

CVE Identifier: CVE-2018-9071, CVE-2018-9073

Summary:

In a recent internal audit, Lenovo identified potential security vulnerabilities in the Lenovo Chassis Management Module (CMM) of the Flex System Chassis. These include the following concerns:

CVE-2018-9071: CMM allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.

CVE-2018-9073: CMM utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.

Mitigation Strategy for Customers (what you should do to protect yourself):

Lenovo recommends customers update their CMM firmware to version 2.0.0 or newer. This firmware is for the Flex System Enterprise Chassis ™ Systems: System 8721(ALL), 7893 (ALL), 8724 (ALL), 7953 (ALL), 7385 (ALL) using the Lenovo Chassis Management Module 2 (CMM2) hardware.

The customer should only connect CMM to trusted management networks, and only permit trusted administrators to administer CMM.

For a complete list of all Lenovo Product Security Advisories, click here.

Revision History:

Revision

|

Date

|

Description

—|—|—

1

|

2018-11-15

|

Initial Release

For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on as “as is” basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.