CVE-2015-3324
First published: Thu Apr 16 2015(Updated: )
The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Lenovo ThinkServer System Manager Baseboard Management Controller firmware | =118.71532 | |
| Lenovo ThinkServer RD350 | ||
| Lenovo ThinkServer RD450 | ||
| Lenovo ThinkServer RD550 | ||
| Lenovo ThinkServer RD650 | ||
| Lenovo ThinkServer TD350 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2015-3324?
CVE-2015-3324 is rated as a high severity vulnerability due to the potential for man-in-the-middle attacks.
How do I fix CVE-2015-3324?
To fix CVE-2015-3324, update the ThinkServer System Manager Baseboard Management Controller firmware to version 1.27.73476 or later.
What systems are affected by CVE-2015-3324?
CVE-2015-3324 affects Lenovo ThinkServer RD350, RD450, RD550, RD650, and TD350 systems that are using outdated firmware.
What is the impact of exploiting CVE-2015-3324?
Exploiting CVE-2015-3324 allows attackers to conduct man-in-the-middle attacks, making it possible to spoof server communications.
Is there a workaround for CVE-2015-3324?
There is no official workaround for CVE-2015-3324 aside from promptly updating the firmware to a secure version.
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/lenovo
- canonical/lenovo thinkserver system manager baseboard management controller firmware
- version/lenovo thinkserver system manager baseboard management controller firmware/118.71532
- canonical/lenovo thinkserver rd350
- canonical/lenovo thinkserver rd450
- canonical/lenovo thinkserver rd550
- canonical/lenovo thinkserver rd650
- canonical/lenovo thinkserver td350