PT-2017-16077 · Lenovo · Lenovo Toolscenter Advanced Settings Utility+2

Published 2017-06-20 · Updated 2017-06-30 · CVE-2017-3743

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo ToolsCenter Advanced Settings Utility (ASU) (affected versions not specified) Lenovo UpdateXpress System Pack Installer (UXSPI) (affected versions not specified) Lenovo Dynamic System Analysis (DSA) (affected versions not specified)

Description The issue allows other users to see the user id and clear text password used to access a second machine when a command is sent via the affected utilities. This occurs when multiple users are concurrently logged into a single system and one user is sending a command to another machine.

Recommendations For Lenovo ToolsCenter Advanced Settings Utility (ASU), consider restricting access to the utility until a fix is available. For Lenovo UpdateXpress System Pack Installer (UXSPI), avoid using the utility for commands that require authentication until the issue is resolved. For Lenovo Dynamic System Analysis (DSA), limit concurrent user access to the system when using the utility to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-3743

Affected Products

Lenovo Dynamic System Analysis

Lenovo Toolscenter Advanced Settings Utility

Lenovo Updatexpress System Pack Installer

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-3743 · Security Note
• https://osv.dev/vulnerability/CVE-2017-3743 · Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-10810 · Vendor Advisory