Lenovo Security Advisory: LEN-29942
Potential Impact: Information disclosure
Severity: High
Scope of Impact: Lenovo-specific
CVE Identifier: CVE-2019-19756
Summary Description:
An internal product security audit of Lenovo XClarity Administrator (LXCA) discovered Windows OS credentials, used to perform driver updates of managed systems, being written to a log file in clear text. This only affects LXCA version 2.6.0 when performing a Windows driver update. Affected logs are only accessible to authorized users in the First Failure Data Capture (FFDC) service log and log files on LXCA.
Mitigation Strategy for Customers (what you should do to protect yourself):
Update your LXCA installation to version 2.6.12 or later.
Installation note: You will need to update to LXCA 2.6.0 before installing the latest fix bundle (v 2.6.12).
References:
LXCA 2.6.12 Fix Bundle: <https://datacentersupport.lenovo.com/us/en/solutions/HT509677>
LXCA Updates: <https://support.lenovo.com/us/en/solutions/lnvo-lxcaupd>
Revision History:
Revision | Date | Description |
---|---|---|
1 | 2020-03-10 | Initial release |
For a complete list of all Lenovo Product Security Advisories, click here.
For the most up to date information, please remain current with updates and advisories from Lenovo regarding your equipment and software. The information provided in this advisory is provided on an βas isβ basis without any warranty or guarantee of any kind. Lenovo reserves the right to change or update this advisory at any time.