A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers and earlier than version 6.60 used in some IBM servers. An attacker providing a crafted user ID and password combination can cause a portion of the authentication routine to overflow its stack, resulting in stack corruption.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00585.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Lenovo Group Ltd. IMM2 affected
Version Status Constraints
Earlier than 4.40 affected —
IBM IMM2 affected
Version Status Constraints
Earlier than 6.60 affected —

Configuration 1 [-]

AND
cpe:2.3:a:lenovo:integrated_management_module_2:*:*:*:*:*:*:*:*
OR cpe:2.3:h:lenovo:flex_system_x240_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x240_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x280_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x440_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x480_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:flex_system_x880:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:nextscale_nx360_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3250_m6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3500_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3550_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3650_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3750_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3850_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:system_x3950_x6:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:a:lenovo:integrated_management_module_2:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ibm:bladecenter_hs22:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:bladecenter_hs23:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:bladecenter_hs23e:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x220_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x222_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x240_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x280_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x440_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x480_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:flex_system_x880_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:idataplex_dx360_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:idataplex_dx360_m4_water_cooled:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:nextscale_nx360_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3100_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3100_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3250_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3250_m5:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3300_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3500_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3530_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3550_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3630_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3650_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3650_m4_bd:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3650_m4_hd:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3750_m4:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3850_x6:-:*:*:*:*:*:*:*
cpe:2.3:h:ibm:system_x3950_x6:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Ibm Subscribe
Bladecenter Hs22 Subscribe
Bladecenter Hs23 Subscribe
Bladecenter Hs23e Subscribe
Flex System X220 M4 Subscribe
Flex System X222 M4 Subscribe
Flex System X240 M4 Subscribe
Flex System X280 M4 Subscribe
Flex System X440 M4 Subscribe
Flex System X480 M4 Subscribe
Flex System X880 M4 Subscribe
Idataplex Dx360 M4 Subscribe
Idataplex Dx360 M4 Water Cooled Subscribe
Nextscale Nx360 M4 Subscribe
System X3100 M4 Subscribe
System X3100 M5 Subscribe
System X3250 M4 Subscribe
System X3250 M5 Subscribe
System X3300 M4 Subscribe
System X3500 M4 Subscribe
System X3530 M4 Subscribe
System X3550 M4 Subscribe
System X3630 M4 Subscribe
System X3650 M4 Subscribe
System X3650 M4 Bd Subscribe
System X3650 M4 Hd Subscribe
System X3750 M4 Subscribe
System X3850 X6 Subscribe
System X3950 X6 Subscribe
Lenovo Subscribe
Flex System X240 M4 Subscribe
Flex System X240 M5 Subscribe
Flex System X280 X6 Subscribe
Flex System X440 M4 Subscribe
Flex System X480 X6 Subscribe
Flex System X880 Subscribe
Integrated Management Module 2 Subscribe
Nextscale Nx360 M5 Subscribe
System X3250 M6 Subscribe
System X3500 M5 Subscribe
System X3550 M5 Subscribe
System X3650 M5 Subscribe
System X3750 M4 Subscribe
System X3850 X6 Subscribe
System X3950 X6 Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2017-12891 A stack overflow vulnerability was discovered within the web administration service in Integrated Management Module 2 (IMM2) earlier than version 4.70 used in some Lenovo servers and earlier than version 6.60 used in some IBM servers. An attacker providing a crafted user ID and password combination can cause a portion of the authentication routine to overflow its stack, resulting in stack corruption.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://support.lenovo.com/us/en/product_security/LEN-19586 cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: lenovo

Published:

Updated: 2024-09-16T16:48:19.094Z

Reserved: 2016-12-16T00:00:00.000Z

Link: CVE-2017-3774

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-04-19T14:29:00.357

Modified: 2024-11-21T03:26:06.600

Link: CVE-2017-3774

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses