Man-in-the-Middle Vulnerability in ThinkServer System Manager by Lenovo
CVE-2015-3324

Currently unrated

Key Information:

Vendor
Lenovo
Status
Thinkserver System Manager Baseboard Management Controller Firmware
Vendor
CVE Published:
16 April 2015

Summary

The ThinkServer System Manager (TSM) Baseboard Management Controller prior to firmware version 1.27.73476 exposes systems to man-in-the-middle attacks by failing to validate server certificates during encrypted remote KVM sessions. This vulnerability allows attackers to potentially spoof server communications, compromising the integrity and confidentiality of data during remote management operations.

References

http://www.securityfocus.com/bid/74199
vdb-entryx_refsource_BID
http://support.lenovo.com/us/en/product_security/tsm_weak_pw
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.