Details of VAR-201706-0355

ID

VAR-201706-0355

CVE

CVE-2017-3744

TITLE

Lenovo System x Server IMM2 Firmware command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2017-005197

DESCRIPTION

In the IMM2 firmware of Lenovo System x servers, remote commands issued by LXCA or other utilities may be captured in the First Failure Data Capture (FFDC) service log if the service log is generated when that remote command is running. Captured command data may contain clear text login information. Authorized users that can capture and export FFDC service log data may have access to these remote commands. Lenovo System x Server IMM2 The firmware contains a command injection vulnerability.Information may be obtained. LenovoSystemxIMM2 is the firmware used by Lenovo servers to provide remote monitoring and control of the server. A security vulnerability exists in LenovoSystemxIMM2 that could allow an attacker to exploit a vulnerability to obtain a login certificate. Lenovo System x is a server of China Lenovo (Lenovo)

Trust: 2.25

sources: NVD: CVE-2017-3744 // JVNDB: JVNDB-2017-005197 // CNVD: CNVD-2017-13250 // VULHUB: VHN-111947

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-13250

AFFECTED PRODUCTS

vendor:	ibm	model:	integrated management module	scope:	lte	version:	6.19	Trust: 1.0
vendor:	lenovo	model:	integrated management module	scope:	lte	version:	4.9	Trust: 1.0
vendor:	ibm	model:	integrated management module	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	integrated management module	scope:	-	version:	-	Trust: 0.8
vendor:	lenovo	model:	flex system m4	scope:	eq	version:	x240<=4.10	Trust: 0.6
vendor:	ibm	model:	integrated management module	scope:	eq	version:	6.19	Trust: 0.6

sources: CNVD: CNVD-2017-13250 // JVNDB: JVNDB-2017-005197 // CNNVD: CNNVD-201706-791 // NVD: CVE-2017-3744

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-3744
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-3744
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2017-13250
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201706-791
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-111947
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-3744
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-13250
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-111947
severity:	MEDIUM
baseScore:	4.0
vectorString:	AV:N/AC:L/AU:S/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	8.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-3744
baseSeverity:	MEDIUM
baseScore:	6.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	3.6
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2017-13250 // VULHUB: VHN-111947 // JVNDB: JVNDB-2017-005197 // CNNVD: CNNVD-201706-791 // NVD: CVE-2017-3744

PROBLEMTYPE DATA

problemtype:	CWE-532	Trust: 1.1
problemtype:	CWE-77	Trust: 0.9

sources: VULHUB: VHN-111947 // JVNDB: JVNDB-2017-005197 // NVD: CVE-2017-3744

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201706-791

TYPE

log information leak

Trust: 0.6

sources: CNNVD: CNNVD-201706-791

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-005197

PATCH

title:	LEN-14054	url:	https://support.lenovo.com/jp/ja/product_security/len-14054	Trust: 0.8
title:	LenovoSystemxIMM2 firmware certificate to obtain a patch for the vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/97553	Trust: 0.6
title:	Lenovo System x IMM2 Fixes for firmware security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=71253	Trust: 0.6

sources: CNVD: CNVD-2017-13250 // JVNDB: JVNDB-2017-005197 // CNNVD: CNNVD-201706-791

EXTERNAL IDS

db:	NVD	id:	CVE-2017-3744	Trust: 3.1
db:	LENOVO	id:	LEN-14054	Trust: 2.3
db:	JVNDB	id:	JVNDB-2017-005197	Trust: 0.8
db:	CNNVD	id:	CNNVD-201706-791	Trust: 0.7
db:	CNVD	id:	CNVD-2017-13250	Trust: 0.6
db:	VULHUB	id:	VHN-111947	Trust: 0.1

sources: CNVD: CNVD-2017-13250 // VULHUB: VHN-111947 // JVNDB: JVNDB-2017-005197 // CNNVD: CNNVD-201706-791 // NVD: CVE-2017-3744

REFERENCES

url:	https://support.lenovo.com/product_security/len-14054	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-3744	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-3744	Trust: 0.8
url:	https://support.lenovo.com/us/zh/product_security/len-14054	Trust: 0.6

sources: CNVD: CNVD-2017-13250 // VULHUB: VHN-111947 // JVNDB: JVNDB-2017-005197 // CNNVD: CNNVD-201706-791 // NVD: CVE-2017-3744

SOURCES

db:	CNVD	id:	CNVD-2017-13250
db:	VULHUB	id:	VHN-111947
db:	JVNDB	id:	JVNDB-2017-005197
db:	CNNVD	id:	CNNVD-201706-791
db:	NVD	id:	CVE-2017-3744

LAST UPDATE DATE

2024-11-23T22:45:39.192000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-13250	date:	2017-07-07T00:00:00
db:	VULHUB	id:	VHN-111947	date:	2019-10-03T00:00:00
db:	JVNDB	id:	JVNDB-2017-005197	date:	2017-07-20T00:00:00
db:	CNNVD	id:	CNNVD-201706-791	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2017-3744	date:	2024-11-21T03:26:03.203

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-13250	date:	2017-07-07T00:00:00
db:	VULHUB	id:	VHN-111947	date:	2017-06-20T00:00:00
db:	JVNDB	id:	JVNDB-2017-005197	date:	2017-07-20T00:00:00
db:	CNNVD	id:	CNNVD-201706-791	date:	2017-06-29T00:00:00
db:	NVD	id:	CVE-2017-3744	date:	2017-06-20T00:29:00.330