Network Security, Patch/Configuration Management, Vulnerability Management

Lenovo patches 14-year-old vulnerability


Lenovo released a patch for a vulnerability introduced 14 years ago via a firmware update by the now-defunct Nortel Networks and its blade server and switch business unit.

The vulnerability CVE-2017-3765 is rated “high” and was linked to Lenovo's Enterprise Networking Operating System (ENOS) that was used in Lenovo and IBM RackSwitch and BladeCenter products.

If exploited, attackers could perform authentication bypass attacks via a mechanism called “HP Backdoor” that could ultimately grant an attacker admin privileges.

An attacker could gain access to the switch management interface, permitting settings changes that could result in exposing traffic passing through the switch, subtle malfunctions in the attached infrastructure, and partial or complete denial of service,” Lenovo said in a security advisory.

Users are advised to update to the latest firmware or Enable LDAP, RADIUS, or TACAS+ remote authentication, , disable the related “Backdoor” and “Secure Backdoor” local authentication fallback settings Disable Telnet and Restrict physical access to the serial console port.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.