CVE-2014-0881

The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive key information or cause a denial of service by leveraging an incorrect configuration. IBM X-Force ID: 91146.

CVSS v3 7.4 HIGH
CVSS v2.0 5.8 MEDIUM

7.4^/10

CVSS v3 : HIGH

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:P

Exploitability : 8.6 / Impact : 4.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://support.lenovo.com/us/en/solutions/ht114524	Third Party Advisory
https://www.ibm.com/blogs/psirt/security-bulletin-tpm-on-the-integrated-management-module-ii-imm2-of-flex-system-x222-compute-node-is-not-configured-correctly-cve-2014-0881/	Vendor Advisory
https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094725	Vendor Advisory
https://support.lenovo.com/us/en/solutions/ht114524	Third Party Advisory
https://www.ibm.com/blogs/psirt/security-bulletin-tpm-on-the-integrated-management-module-ii-imm2-of-flex-system-x222-compute-node-is-not-configured-correctly-cve-2014-0881/	Vendor Advisory
https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094725	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:ibm:integrated_management_module_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:ibm:flex_system_x222:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-04-25 20:29

Updated : 2024-11-21 02:02

NVD link : CVE-2014-0881

Mitre link : CVE-2014-0881

CVE.ORG link : CVE-2014-0881

JSON object : View

Products Affected

ibm

integrated_management_module_firmware
flex_system_x222

CWE

CWE-284

Improper Access Control

{"id": "CVE-2014-0881", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "published": "2018-04-25T20:29:00.370", "references": [{"url": "https://support.lenovo.com/us/en/solutions/ht114524", "tags": ["Third Party Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/blogs/psirt/security-bulletin-tpm-on-the-integrated-management-module-ii-imm2-of-flex-system-x222-compute-node-is-not-configured-correctly-cve-2014-0881/", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094725", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://support.lenovo.com/us/en/solutions/ht114524", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/blogs/psirt/security-bulletin-tpm-on-the-integrated-management-module-ii-imm2-of-flex-system-x222-compute-node-is-not-configured-correctly-cve-2014-0881/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/home/docdisplay?lndocid=MIGR-5094725", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "The TPM on Integrated Management Module II (IMM2) on IBM Flex System x222 servers with firmware 1.00 through 3.56 allows remote attackers to obtain sensitive key information or cause a denial of service by leveraging an incorrect configuration. IBM X-Force ID: 91146."}, {"lang": "es", "value": "El TPM en Integrated Management Module II (IMM2) en los servidores IBM Flex System x222 con firmware desde la versi\u00f3n 1.00 hasta la 3.56 permite que atacantes remotos obtengan informaci\u00f3n sensible clave o provoquen una denegaci\u00f3n de servicio (DoS) aprovechando una configuraci\u00f3n incorrecta. IBM X-Force ID: 91146."}], "lastModified": "2024-11-21T02:02:58.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ibm:integrated_management_module_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F01925D-78D1-4F92-92C4-DAAD6CE4105A", "versionEndIncluding": "3.56", "versionStartIncluding": "1.00"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:flex_system_x222:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2573005F-810D-463C-BAA4-319500EE5471"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}