Vulnerability CVE-2017-3774 - CERT Civis.Net

Vulnerability Name:

CVE-2017-3774 (CCN-141553)

Assigned:

2016-12-16

Published:

2018-04-13

Updated:

2018-05-24

Summary:

A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers and earlier than version 6.60 used in some IBM servers. An attacker providing a crafted user ID and password combination can cause a portion of the authentication routine to overflow its stack, resulting in stack corruption.

CVSS v3 Severity:

9.8 Critical (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2017-3774

Source: XF
Type: UNKNOWN
lenovo-cve20173774-dos(141553)

Source: CCN
Type: Lenovo Security Advisory: LEN-19586
IMM2 Web Service Stack Overflow

Source: CONFIRM
Type: Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-19586

Vulnerable Configuration:

Configuration 1:

cpe:/a:lenovo:integrated_management_module_2:*:*:*:*:*:*:*:* (Version < 4.70)

AND

cpe:/h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:flex_system_x240_m5:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:flex_system_x280_x6:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:flex_system_x480_x6:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:flex_system_x880:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:nextscale_nx360_m5:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:system_x3250_m6:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:system_x3500_m5:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:system_x3550_m5:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:system_x3650_m5:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:system_x3850_x6:-:*:*:*:*:*:*:*

OR cpe:/h:lenovo:system_x3950_x6:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:lenovo:integrated_management_module_2:*:*:*:*:*:*:*:* (Version < 6.60)

AND

cpe:/h:ibm:bladecenter_hs22:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:bladecenter_hs23:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:bladecenter_hs23e:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_x220_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_x280_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_x480_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:flex_system_x880_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:idataplex_dx360_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:nextscale_nx360_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3100_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3100_m5:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3250_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3250_m5:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3300_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3500_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3530_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3550_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3630_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3650_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3650_m4_bd:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3650_m4_hd:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3750_m4:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3850_x6:-:*:*:*:*:*:*:*

OR cpe:/h:ibm:system_x3950_x6:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/h:ibm:integrated_management_module_ii:-:*:*:*:*:*:*:*

Denotes that component is vulnerable