Lenovo Patches Arbitrary Code Execution Flaw

Lenovo issued a pair of security advisories on Friday for its popular ThinkPad line and System x servers. One bug is tied to an authentication flaw in the Secure Boot process; and the other to a vulnerability that would allow for arbitrary code execution. The company’s internal testing team...

CVE-2017-3775

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

Code injection

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

CVE-2017-3775

Some Lenovo System x server BIOS/UEFI versions, when Secure Boot mode is enabled by a system administrator, do not properly authenticate signed code before booting it. As a result, an attacker with physical access to the system could boot unsigned code...

CVE-2017-3775

CVE-2017-3775 affects Lenovo System x server BIOS/UEFI where, when Secure Boot is enabled, some versions fail to properly authenticate signed code before boot. This could allow an attacker with physical access to boot unsigned code. Lenovo’s advisory LEN-20241 recommends applying the relevant BIO...

CVE-2014-0882

CVE-2014-0882 affects IBM IMM2 (Integrated Management Module II) across Flex System x220/x222/x240/x440, NeXtScale nx360 M4, System x3100/M4, x3250/M4, x3500/M4, x3530/M4, x3550/M4, x3630/M4, x3650/M4, x3750/M4, and x iDataPlex dx360 M4, where certain configurations may cause generated Service Ad...

Lenovo System x-Series and IBM System x-Series Denial of Service Vulnerabilities

Lenovo System x is a server from Lenovo in China.IBM System x is a server from IBM in the United States. A security vulnerability exists in the Lenovo System x series prior to version 4.4 and the IBM System x series prior to version 6.4. An attacker could exploit this vulnerability to cause a...

Authentication flaw

An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x. Flooding the IMM2 with a high volume of authentication failures via the Common Information Model CIM used ...

CVE-2017-3768

An unprivileged attacker with connectivity to the IMM2 could cause a denial of service attack on the IMM2 Versions earlier than 4.4 for Lenovo System x and earlier than 6.4 for IBM System x. Flooding the IMM2 with a high volume of authentication failures via the Common Information Model CIM used ...

CVE-2017-3768

CVE-2017-3768 affects IBM IMM2 (System x, Flex, BladeCenter) and Lenovo System x variants. A remote, unprivileged attacker with CIM connectivity can flood IMM2 with authentication failures, exhausting memory and causing the device to reboot. Affected versions are Lenovo System x (pre-4.4) and IBM...

Lenovo System x IMM2 Firmware Certificate Acquisition Vulnerability

Lenovo System x IMM2 is the firmware used in Lenovo servers in which it provides remote monitoring and control of the server. The Lenovo System x IMM2 has a security vulnerability that can be exploited by an attacker to obtain login credentials...

Design/Logic Flaw

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture FFDC service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information...

CVE-2017-3744

CVE-2017-3744 affects Lenovo System x IMM2 firmware. Remote commands issued by LXCA/other utilities may be logged in the FFDC service log, potentially exposing clear-text login information to authorized users who can capture/export FFDC data. Impact is confined to Lenovo System x IMM2, with the v...

CVE-2016-8226

The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure...

Code injection

The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure...

CVE-2016-8226

CVE-2016-8226 affects Lenovo System X M5, M6, and X6 BIOS. The vulnerability allows an administrator to cause a denial of service by updating a UEFI data structure, which can prevent POST and boot. Descriptions in the Lenovo LEN-11306 advisory confirm a Lenovo-specific BIOS/POST impact and recomm...

Denial of service attack on Lenovo System X M5, M6, and X6 systems - us

Lenovo Security Advisory: LEN-11306 Potential Impact: Denial of service Severity: Medium Scope of Impact: Lenovo-specific CVE Identifier: CVE-2016-8226 Summary Description: A vulnerability was identified in the BIOS of Lenovo System X M5, M6, and X6 systems. An attacker with administrative access...