PT-2017-16077 · Lenovo · Lenovo Toolscenter Advanced Settings Utility+2

Publicado 2017-06-20 · Atualizado 2017-06-30 · CVE-2017-3743

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo ToolsCenter Advanced Settings Utility (ASU) (affected versions not specified) Lenovo UpdateXpress System Pack Installer (UXSPI) (affected versions not specified) Lenovo Dynamic System Analysis (DSA) (affected versions not specified)

Description The issue allows other users to see the user id and clear text password used to access a second machine when a command is sent via the affected utilities. This occurs when multiple users are concurrently logged into a single system and one user is sending a command to another machine.

Recommendations For Lenovo ToolsCenter Advanced Settings Utility (ASU), consider restricting access to the utility until a fix is available. For Lenovo UpdateXpress System Pack Installer (UXSPI), avoid using the utility for commands that require authentication until the issue is resolved. For Lenovo Dynamic System Analysis (DSA), limit concurrent user access to the system when using the utility to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-3743

Produtos afetados

Lenovo Dynamic System Analysis

Lenovo Toolscenter Advanced Settings Utility

Lenovo Updatexpress System Pack Installer

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-3743 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-3743 · Aviso do Fabricante
• https://support.lenovo.com/us/en/product_security/LEN-10810 · Aviso do Fabricante