PC maker Lenovo issued a fix for a hardcoded password flaw impacting ThinkPad, ThinkCentre and ThinkStation laptops. The flaw affects nearly a dozen Lenovo laptop models that run versions of Microsoft Windows 7, 8 and the 8.1 operating system.
The vulnerability was disclosed by Lenovo on Thursday who also offered a patch to fix affected systems.
“Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users’ Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system in which it is installed,” according to Mitre’s Common Vulnerabilities and Exposures description of the vulnerability (CVE-2017-3762).
Lenovo credited Jackson Thuraisamy, a senior security consultant with Security Compass, for finding and disclosing the flaw.
Mitigation includes updating Lenovo’s Fingerprint Manager Pro to version 8.01.87 or later. Lenovo laptops running Windows 10 are not impacted by the flaw because that version of Microsoft’s operating system natively supports fingerprint reader technology.
Lenovo is urging users of the following laptops to update their Lenovo Fingerprint Manager Pro version to 8.01.87 or higher.
- ThinkPad L560
- ThinkPad P40 Yoga, P50s
- ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560
- ThinkPad W540, W541, W550s
- ThinkPad X1 Carbon (Type 20A7, 20A8), X1 Carbon (Type 20BS, 20BT)
- ThinkPad X240, X240s, X250, X260
- ThinkPad Yoga 14 (20FY), Yoga 460
- ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z
- ThinkStation E32, P300, P500, P700, P900
Source: ThreatPost
