CVE-2015-3324: Medium severity lenovo thinkserver system manager baseboard management controller firmware vulnerability

Published Apr 16, 2015

Updated

The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers.

Affected Software

6 affected components

Lenovo Thinkserver System Manager Baseboard Management Controller Firmware=118.71532

Lenovo ThinkServer RD350

Lenovo Thinkserver Rd450

Lenovo Thinkserver Rd550

Lenovo Thinkserver Rd650

Lenovo Thinkserver Td350

Remediation

Patch Available

http://support.lenovo.com/us/en/product_security/tsm_weak_pw

Event History

Apr 16, 2015

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-3324?

CVE-2015-3324 is rated as a high severity vulnerability due to the potential for man-in-the-middle attacks.

How do I fix CVE-2015-3324?

To fix CVE-2015-3324, update the ThinkServer System Manager Baseboard Management Controller firmware to version 1.27.73476 or later.

What systems are affected by CVE-2015-3324?

CVE-2015-3324 affects Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 systems that are using outdated firmware.

What is the impact of exploiting CVE-2015-3324?

Exploiting CVE-2015-3324 allows attackers to conduct man-in-the-middle attacks, making it possible to spoof server communications.

Is there a workaround for CVE-2015-3324?

There is no official workaround for CVE-2015-3324 aside from promptly updating the firmware to a secure version.