Security Bulletin: Vulnerabilities in cURL affect System x Integrated Management Module (IMM) (CVE-2013-2174, CVE-2014-0015, CVE-2014-0138, CVE-2014-0139)

Summary Several cURL vulnerabilities were disclosed. This bulletin addresses these cURL vulnerabilities that affect IMM. Vulnerability Details Abstract Several cURL vulnerabilities were disclosed. This bulletin addresses these cURL vulnerabilities that affect IMM. Content Vulnerability Details:...

Security Bulletin: Vulnerabilities in cURL affect System x Integrated Management Module (IMM) (CVE-2013-2174, CVE-2014-0015, CVE-2014-138, CVE-2014-0139)

Summary Several cURL vulnerabilities were disclosed. This bulletin addresses these cURL vulnerabilities that affect IMM. Vulnerability Details Abstract Several cURL vulnerabilities were disclosed. This bulletin addresses these cURL vulnerabilities that affect IMM. Vulnerability Details CVE-ID:...

Security Bulletin: Vulnerabilities in SSLv3 and OpenSSL affect System x Integrated Management Module (IMM1) (CVE-2014-3566, CVE-2014-3568)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. This bulletin addresses the POODLE issue which affected the IMM1 as well as another issue in OpenSSL disclosed in October 2014. Vulnerability Details Abstract SSLv...

Security Bulletin: OpenSSL Security Issues with Intel® MPSS for use on Intel Xeon Phi PCIe cards sold by IBM (CVE-2014-0076, CVE-2014-0195, CVE-2014-0198, CVE-2014-0221, CVE-2014-0224, CVE-2014-3470 and CVE-2010-5298)

Vulnerability Details Abstract This Security Bulletin discusses several security vulnerabilities that affect previous versions of Intel® Manycore Platform Software Stack Intel® MPSS for use on Intel Xeon Phi PCIe cards sold by IBM for use with IBM System x servers. Intel's coprocessors are...

Security Bulletin: Vulnerability in SSLv3 affects Integrated Management Module 2 (IMM2) (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Integrated Management Module 2 IMM2. Vulnerability Details Summary SSLv3 contains a vulnerability that has been referred to as the Padding Orac...

Security Bulletin: Vulnerabilities in Bash affect certain Intel Xeon Phi PCIe cards supported in IBM System x servers (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278)

Summary Six Bash vulnerabilities were disclosed in September 2014. This bulletin addresses the vulnerabilities that have been referred to as "Bash Bug" or "Shellshock" and two memory corruption vulnerabilities. Bash is used by Intel MPSS Manycore Platform Software Stack used with the Intel Xeon P...

Security Bulletin: IBM System x Integrated Management Module (IMM) is affected by the following OpenSSL vulnerabilities: CVE-2014-0224, CVE-2014-0076

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project Vulnerability Details Abstract Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project Content Vulnerability Detail...

Security Bulletin: IBM System x Integrated Management Module (IMM) Lighttpd W (CVE-2011-4362, CVE-2010-0295, CVE-2008-4360, CVE-2008-4359, CVE-20084298, CVE-2008-1531)

Summary Older versions of lighttpd, used by System x IMM contain multiple vulnerabilities. Vulnerability Details Abstract Older versions of lighttpd, used by System x IMM contain multiple vulnerabilities. Content Vulnerability Details: CVE ID: CVE-2011-4362 Description: Integer signedness error i...

Security Bulletin: IBM System x and Flex Systems OpenSSH Vulnerabilities (CVE-2012-0814, CVE-2008-5161)

Summary Older versions of OpenSSH, used by several System x and Flex Systems products, contain multiple vulnerabilities. Vulnerability Details Abstract Older versions of OpenSSH, used by several System x and Flex Systems products, contain multiple vulnerabilities. Content Vulnerability Details:...

System x Secure Boot Vulnerability - Lenovo Support US

No description provided...

Missing System x Flash Memory Write Protection Lock Bit

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

CVE-2018-9085

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

CVE-2018-9085

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

CVE-2018-9085

CVE-2018-9085 affects Lenovo/IBM System x family vendors. A missing write-protection lock bit after boot enables a locally authenticated attacker with admin access to modify flash areas containing Intel SPS and system flash descriptors. This can lead to system instability or DoS-like behavior, as...

CVE-2018-9085 Missing System x Flash Memory Write Protection Lock Bit

A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an attacker with administrator access to modify the subset of flash memory containing Intel Server Platform Services SPS and the system Flash Descriptors...

Missing System x Flash Memory Write Protection Lock Bit - US

Lenovo Security Advisory: LEN-24477 Potential Impact: Denial of service Severity: High Scope of Impact: Lenovo-specific CVE Identifier: CVE-2018-9085 Summary Description: A write protection lock bit was left unset after boot on an older generation of System x server, potentially allowing an...

Missing System x Flash Memory Write Protection Lock Bit - Lenovo Support US

No description provided...

CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Leno...

CVE-2018-9068

The CVE-2018-9068 issue affects IBM/Lenovo Integrated Management Module II (IMM2) FFDC data disclosure. In affected IMM2 firmware (Lenovo System x prior to 4.90 and IBM System x prior to 6.80), the SFTP server used for FFDC data access used hard-coded credentials described in the IMM2 documentati...