Lenovo Fixes Hardcoded Password Flaw Impacting ThinkPad Fingerprint Scanners

Lenovo Fixes Hardcoded Password Flaw Impacting ThinkPad Fingerprint Scanners


Lenovo Fixes Hardcoded Password Flaw Impacting ThinkPad Fingerprint Scanners

PC maker Lenovo issued a fix for a hardcoded password flaw impacting ThinkPad, ThinkCentre and ThinkStation laptops. The flaw affects nearly a dozen Lenovo laptop models that run versions of Microsoft Windows 7, 8 and the 8.1 operating system.

The vulnerability was disclosed by Lenovo on Thursday who also offered a patch to fix affected systems.

“Sensitive data stored by Lenovo Fingerprint Manager Pro, version 8.01.86 and earlier, including users’ Windows logon credentials and fingerprint data, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system in which it is installed,” according to Mitre’s Common Vulnerabilities and Exposures description of the vulnerability (CVE-2017-3762).

Lenovo credited Jackson Thuraisamy, a senior security consultant with Security Compass, for finding and disclosing the flaw.

Mitigation includes updating Lenovo’s Fingerprint Manager Pro to version 8.01.87 or later. Lenovo laptops running Windows 10 are not impacted by the flaw because that version of Microsoft’s operating system natively supports fingerprint reader technology.

Lenovo is urging users of the following laptops to update their Lenovo Fingerprint Manager Pro version to 8.01.87 or higher.

  • ThinkPad L560
  • ThinkPad P40 Yoga, P50s
  • ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560
  • ThinkPad W540, W541, W550s
  • ThinkPad X1 Carbon (Type 20A7, 20A8), X1 Carbon (Type 20BS, 20BT)
  • ThinkPad X240, X240s, X250, X260
  • ThinkPad Yoga 14 (20FY), Yoga 460
  • ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z
  • ThinkStation E32, P300, P500, P700, P900

Categories: Cryptography, Privacy, Vulnerabilities

Recommended Reads

A bug in Lenovo’s Enterprise Networking Operating System could allow an attacker to launch an authentication bypass attack.

Lenovo customers are being told to update their Android tablets and handsets to protect themselves against a handful of critical vulnerabilities impacting tens of millions of vulnerable Lenovo devices.

A flawed Infineon Technology chipset left HP, Lenovo and Microsoft devices open to what is called a ‘practical factorization attack,’ in which an attacker computes the private part of an RSA key.