Lenovo/IBM Products CVE-2017-3765 Local Authentication Bypass Vulnerability

Bugtraq ID:	102741
Class:	Design Error
CVE:	CVE-2017-3765
Remote:	No
Local:	Yes
Published:	Jan 10 2018 12:00AM
Updated:	Jan 10 2018 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Lenovo RackSwitch G8332 8.4.6.0 Lenovo RackSwitch G8296 8.4.6.0 Lenovo RackSwitch G8272 (ThinkAgile CX4200/CX4600) 8.4.6.0 Lenovo RackSwitch G8264CS 8.4.6.0 Lenovo RackSwitch G8264 8.4.6.0 Lenovo RackSwitch G8124E (ThinkAgile CX2200) 8.4.6.0 Lenovo RackSwitch G8052 8.4.6.0 Lenovo RackSwitch G7052 (ThinkAgile CX4200/CX4600) 8.4.6.0 Lenovo RackSwitch G7028 (ThinkAgile CX2200) 8.4.6.0 Lenovo Flex System SI4091 System Interconnect Module 8.4.6.0 Lenovo Flex System Fabric SI4093 10Gb System Interconnect Module 8.4.6.0 Lenovo Flex System Fabric EN4093R 10Gb Scalable Switch 8.4.6.0 Lenovo Flex System Fabric CN4093 10Gb Converged Scalable Switch 8.4.6.0 Lenovo Enterprise Networking Operating System 0 IBM RackSwitch G8332 7.7.27.0 IBM RackSwitch G8316 7.9.21.0 IBM RackSwitch G8264T 7.9.21.0 IBM RackSwitch G8264CS 7.8.18.0 IBM RackSwitch G8264 7.11.11.0 IBM RackSwitch G8124E 7.11.11.0 IBM RackSwitch G8124 7.11.11.0 IBM RackSwitch G8052 7.11.11.0 IBM Flex System�?� Fabric 7.8.18.0 IBM BladeCenter Virtual Fabric 10Gb Switch Module 7.8.14.0 IBM BladeCenter Layer 2/3 Copper Ethernet Switch Module 5.3.12.0 IBM Bladecenter 1:10G Uplink Ethernet switch Module 7.4.18.0 IBM 1G L2-7 SLB switch for Bladecenter 21.0.26.0
Not Vulnerable:

Lenovo/IBM Products CVE-2017-3765 Local Authentication Bypass Vulnerability

Lenovo/IBM Products are prone to a local authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions. This may lead to further attacks.

Lenovo/IBM Products CVE-2017-3765 Local Authentication Bypass Vulnerability

References:

• Lenovo Homepage (lenovo)
  
• Enterprise Networking Operating System (ENOS) Authentication Bypass in Lenovo an (lenovo)