Lenovo corrige falha de senha de escâner de impressão digital

Lenovo corrige falha de senha de escâner de impressão digital

O fabricante de PC Lenovo emitiu uma correção para uma falha de senha codificada que afeta os laptops ThinkPad, ThinkCentre e ThinkStation.

A falha afeta quase uma dúzia de modelos de laptop Lenovo que executam versões do Microsoft Windows 7, 8 e do sistema operacional 8.1.

JTdCJTIyaWQlMjIlM0ElMjIyMjA3ODI4ODA2NSUyMiUyQyUyMm5ldHdvcmtDb2RlJTIyJTNBJTIyMjIwNjQxNDU2MDMlMjIlMkMlMjJlZmZlY3RpdmVSb290QWRVbml0SWQlMjIlM0ElMjIyMjA2MzE0NTc2OCUyMiUyQyUyMm5hbWUlMjIlM0ElMjJERU5UUk9fRE9fQVJUSUdPX0RFU0tUT1AlMjIlMkMlMjJwYXJlbnRQYXRoJTIyJTNBJTdCJTIyaWQlMjIlM0ElMjIyMjA2MzE0NTc2OCUyMiUyQyUyMm5hbWUlMjIlM0ElMjJjYS1wdWItOTQ5NzEyODAxNzk3Mzk5OSUyMiUyQyUyMmFkVW5pdENvZGUlMjIlM0ElMjJjYS1wdWItOTQ5NzEyODAxNzk3Mzk5OSUyMiU3RCUyQyUyMmFkVW5pdENvZGUlMjIlM0ElMjJERU5UUk9fRE9fQVJUSUdPX0RFU0tUT1AlMjIlMkMlMjJkZXNjcmlwdGlvbiUyMiUzQSUyMiUyMiUyQyUyMmlzRmx1aWQlMjIlM0FmYWxzZSUyQyUyMmlzTmF0aXZlJTIyJTNBdHJ1ZSUyQyUyMmFkVW5pdFNpemVzJTIyJTNBJTVCJTdCJTIyc2l6ZSUyMiUzQSU3QiUyMndpZHRoJTIyJTNBJTIyMzAwJTIyJTJDJTIyaGVpZ2h0JTIyJTNBJTIyMjUwJTIyJTJDJTIyaXNBc3BlY3RSYXRpbyUyMiUzQSUyMmZhbHNlJTIyJTdEJTJDJTIyZW52aXJvbm1lbnRUeXBlJTIyJTNBJTIyQlJPV1NFUiUyMiUyQyUyMmZ1bGxEaXNwbGF5U3RyaW5nJTIyJTNBJTIyMzAweDI1MCUyMiUyQyUyMmlzQXVkaW8lMjIlM0ElMjJmYWxzZSUyMiU3RCUyQyU3QiUyMnNpemUlMjIlM0ElN0IlMjJ3aWR0aCUyMiUzQSUyMjMzNiUyMiUyQyUyMmhlaWdodCUyMiUzQSUyMjI4MCUyMiUyQyUyMmlzQXNwZWN0UmF0aW8lMjIlM0ElMjJmYWxzZSUyMiU3RCUyQyUyMmVudmlyb25tZW50VHlwZSUyMiUzQSUyMkJST1dTRVIlMjIlMkMlMjJmdWxsRGlzcGxheVN0cmluZyUyMiUzQSUyMjMzNngyODAlMjIlMkMlMjJpc0F1ZGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlMkMlN0IlMjJzaXplJTIyJTNBJTdCJTIyd2lkdGglMjIlM0ElMjI1ODAlMjIlMkMlMjJoZWlnaHQlMjIlM0ElMjI0MDAlMjIlMkMlMjJpc0FzcGVjdFJhdGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlMkMlMjJlbnZpcm9ubWVudFR5cGUlMjIlM0ElMjJCUk9XU0VSJTIyJTJDJTIyZnVsbERpc3BsYXlTdHJpbmclMjIlM0ElMjI1ODB4NDAwJTIyJTJDJTIyaXNBdWRpbyUyMiUzQSUyMmZhbHNlJTIyJTdEJTJDJTdCJTIyc2l6ZSUyMiUzQSU3QiUyMndpZHRoJTIyJTNBJTIyNzI4JTIyJTJDJTIyaGVpZ2h0JTIyJTNBJTIyOTAlMjIlMkMlMjJpc0FzcGVjdFJhdGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlMkMlMjJlbnZpcm9ubWVudFR5cGUlMjIlM0ElMjJCUk9XU0VSJTIyJTJDJTIyZnVsbERpc3BsYXlTdHJpbmclMjIlM0ElMjI3Mjh4OTAlMjIlMkMlMjJpc0F1ZGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlNUQlN0Q=

A vulnerabilidade foi revelada pela Lenovo na quinta-feira, que também ofereceu um patch para corrigir sistemas afetados.

A FALHA

“Os dados sensíveis armazenados pelo Lenovo Fingerprint Manager Pro, versão 8.01.86 e anteriores, incluindo as credenciais de logon do Windows e os dados de impressão digital, são criptografados usando um algoritmo fraco.  Contém uma senha codificada e é acessível a todos os usuários locais com acesso administrativo ao sistema no qual está instalado “, de acordo com a descrição de vulnerabilidade da Mitre’s Common Vulnerabilities and Exposures  ( CVE-2017-3762 ).

A Lenovo creditou a Jackson Thunasamy, um consultor de segurança sênior da Security Compass, para encontrar e divulgar a falha.

A mitigação da falha inclui a atualização do Fingerprint Manager Pro da Lenovo para a  versão 8.01.87  ou posterior. Os laptops Lenovo que executam o Windows 10 não são afetados pela falha porque essa versão do sistema operacional da Microsoft suporta nativamente a tecnologia de leitores de impressão digital .

A Lenovo pede aos usuários, dos seguintes laptops, que atualizem sua versão do Lenovo Fingerprint Manager Pro para a 8.01.87 ou superior.

  • ThinkPad L560
  • ThinkPad P40 Yoga, P50s
  • ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560
  • ThinkPad W540, W541, W550s
  • ThinkPad X1 Carbon (Tipo 20A7, 20A8), X1 Carbono (Tipo 20BS, 20BT)
  • ThinkPad X240, X240s, X250, X260
  • ThinkPad Yoga 14 (20FY), Yoga 460
  • ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z
  • ThinkStation E32, P300, P500, P700, P900

 

[su_button url=”https://threatpost.com/lenovo-fixes-hardcoded-password-flaw-impacting-thinkpad-fingerprint-scanners/129680/” target=”blank” text_shadow=”0px 0px 0px #000000″ rel=”nofollow”]FONTE: THREATPOST[/su_button]

JTdCJTIyaWQlMjIlM0ElMjIyMjA5Nzk1NDA2NSUyMiUyQyUyMm5ldHdvcmtDb2RlJTIyJTNBJTIyMjIwNjQxNDU2MDMlMjIlMkMlMjJlZmZlY3RpdmVSb290QWRVbml0SWQlMjIlM0ElMjIyMjA2MzE0NTc2OCUyMiUyQyUyMm5hbWUlMjIlM0ElMjJTVV9ERU5UUk9fRE9fQVJUSUdPX0RFU0tUT1BfMyUyMiUyQyUyMnBhcmVudFBhdGglMjIlM0ElN0IlMjJpZCUyMiUzQSUyMjIyMDYzMTQ1NzY4JTIyJTJDJTIybmFtZSUyMiUzQSUyMmNhLXB1Yi05NDk3MTI4MDE3OTczOTk5JTIyJTJDJTIyYWRVbml0Q29kZSUyMiUzQSUyMmNhLXB1Yi05NDk3MTI4MDE3OTczOTk5JTIyJTdEJTJDJTIyYWRVbml0Q29kZSUyMiUzQSUyMlNVX0RFTlRST19ET19BUlRJR09fREVTS1RPUF8zJTIyJTJDJTIyZGVzY3JpcHRpb24lMjIlM0ElMjIlMjIlMkMlMjJpc0ZsdWlkJTIyJTNBdHJ1ZSUyQyUyMmlzTmF0aXZlJTIyJTNBdHJ1ZSUyQyUyMmFkVW5pdFNpemVzJTIyJTNBJTVCJTdCJTIyc2l6ZSUyMiUzQSU3QiUyMndpZHRoJTIyJTNBJTIyMzAwJTIyJTJDJTIyaGVpZ2h0JTIyJTNBJTIyMjUwJTIyJTJDJTIyaXNBc3BlY3RSYXRpbyUyMiUzQSUyMmZhbHNlJTIyJTdEJTJDJTIyZW52aXJvbm1lbnRUeXBlJTIyJTNBJTIyQlJPV1NFUiUyMiUyQyUyMmZ1bGxEaXNwbGF5U3RyaW5nJTIyJTNBJTIyMzAweDI1MCUyMiUyQyUyMmlzQXVkaW8lMjIlM0ElMjJmYWxzZSUyMiU3RCUyQyU3QiUyMnNpemUlMjIlM0ElN0IlMjJ3aWR0aCUyMiUzQSUyMjMzNiUyMiUyQyUyMmhlaWdodCUyMiUzQSUyMjI4MCUyMiUyQyUyMmlzQXNwZWN0UmF0aW8lMjIlM0ElMjJmYWxzZSUyMiU3RCUyQyUyMmVudmlyb25tZW50VHlwZSUyMiUzQSUyMkJST1dTRVIlMjIlMkMlMjJmdWxsRGlzcGxheVN0cmluZyUyMiUzQSUyMjMzNngyODAlMjIlMkMlMjJpc0F1ZGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlMkMlN0IlMjJzaXplJTIyJTNBJTdCJTIyd2lkdGglMjIlM0ElMjI1ODAlMjIlMkMlMjJoZWlnaHQlMjIlM0ElMjI0MDAlMjIlMkMlMjJpc0FzcGVjdFJhdGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlMkMlMjJlbnZpcm9ubWVudFR5cGUlMjIlM0ElMjJCUk9XU0VSJTIyJTJDJTIyZnVsbERpc3BsYXlTdHJpbmclMjIlM0ElMjI1ODB4NDAwJTIyJTJDJTIyaXNBdWRpbyUyMiUzQSUyMmZhbHNlJTIyJTdEJTJDJTdCJTIyc2l6ZSUyMiUzQSU3QiUyMndpZHRoJTIyJTNBJTIyNzI4JTIyJTJDJTIyaGVpZ2h0JTIyJTNBJTIyOTAlMjIlMkMlMjJpc0FzcGVjdFJhdGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlMkMlMjJlbnZpcm9ubWVudFR5cGUlMjIlM0ElMjJCUk9XU0VSJTIyJTJDJTIyZnVsbERpc3BsYXlTdHJpbmclMjIlM0ElMjI3Mjh4OTAlMjIlMkMlMjJpc0F1ZGlvJTIyJTNBJTIyZmFsc2UlMjIlN0QlNUQlN0Q=
Nubank Cripto adiciona dez novas opções de criptomoedas em menos de 1 ano
The Internet Is Fascinated By This Basketball Player

The Internet Is Fascinated By This Basketball Player

Eget dolor posuere convallis vel vel nisl. Nulla sagittis efficitur ex, at sodales massa pulvinar a. Nunc quis lacinia…
13 Reasons I Can’t Stop Thinking About Thai Massage

13 Reasons I Can’t Stop Thinking About Thai Massage

Posuere convallis vel vel nisl. Nulla sagittis efficitur ex, at sodales massa pulvinar a. Nunc quis lacinia eros. Fusce…
15 Extreme Rooftoppers That Prove People Are Damn Awesome

15 Extreme Rooftoppers That Prove People Are Damn Awesome

Vel vel nisl. Nulla sagittis efficitur ex, at sodales massa pulvinar a. Nunc quis lacinia eros. Fusce ac ipsum…