Integrated Management Module 2 (IMM2) First Failure Data Capture (FFDC) Information Disclosure - US

Lenovo Security Advisory: LEN-20227

Potential Impact: Information disclosure

Severity: Medium

Scope of Impact: Lenovo-specific

CVE Identifier: CVE-2018-9068

Summary Description:

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. The credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data.

Mitigation Strategy for Customers (what you should do to protect yourself):

Update IMM2 firmware to the version (or newer) described for your model in the Product Impact section. After applying this update, the IMM2 will create random SFTP credentials for use with OneCLI.