CVE-2018-9068 : Security Advisory and Response
Learn about CVE-2018-9068, an information disclosure vulnerability in Lenovo and IBM System x IMM2 firmware versions earlier than 4.90 and 6.80. Find out the impact, affected systems, exploitation method, and mitigation steps.
CVE-2018-9068, published on July 26, 2018, addresses an information disclosure vulnerability in Lenovo and IBM System x IMM2 firmware versions prior to 4.90 and 6.80, respectively.
Understanding CVE-2018-9068
This CVE entry highlights a security issue that could allow unauthorized access to sensitive data through hardcoded SFTP server credentials.
What is CVE-2018-9068?
The vulnerability in Lenovo and IBM System x IMM2 firmware versions earlier than 4.90 and 6.80, respectively, enables attackers with network access to retrieve collected First Failure Data Capture (FFDC) logs and diagnostic information.
The Impact of CVE-2018-9068
The hardcoded SFTP server credentials in affected firmware versions could lead to unauthorized disclosure of sensitive FFDC data, compromising system security.
Technical Details of CVE-2018-9068
This section delves into the specifics of the vulnerability.
Vulnerability Description
The IMM2 First Failure Data Capture feature in Lenovo and IBM System x IMM2 firmware versions prior to 4.90 and 6.80, respectively, exposes SFTP server credentials, allowing unauthorized access to FFDC data.
Affected Systems and Versions
- Product: System x IMM2
- Vendor: Lenovo Group Ltd.
- Affected Versions: Firmware versions earlier than 4.90
- Vendor: IBM Corporation
- Affected Versions: Firmware versions earlier than 6.80
Exploitation Mechanism
Attackers with access to the management network can exploit the hardcoded SFTP server credentials to download sensitive FFDC logs and diagnostic information.
Mitigation and Prevention
Protecting systems from CVE-2018-9068 involves immediate actions and long-term security measures.
Immediate Steps to Take
- Update IMM2 firmware to versions 4.90 for Lenovo and 6.80 for IBM to mitigate the vulnerability.
- Restrict network access to prevent unauthorized parties from reaching the management interface.
Long-Term Security Practices
- Regularly monitor and audit network traffic for any suspicious activities.
- Implement strong access controls and authentication mechanisms to secure sensitive data.
Patching and Updates
- Apply firmware updates promptly to address known vulnerabilities and enhance system security.