Lenovo Connect2 up to 4.2.5 on Windows/Android Ad-hoc Connection Password information disclosure

Summaryinfo

A vulnerability was found in Lenovo Connect2 up to 4.2.5 on Windows/Android and classified as problematic. This affects an unknown function of the component Ad-hoc Connection Handler. The manipulation as part of Password results in information disclosure (Password). This vulnerability is identified as CVE-2017-3742. The attack can only be performed from the local network. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Lenovo Connect2 up to 4.2.5 on Windows/Android. Affected is an unknown code of the component Ad-hoc Connection Handler. The manipulation as part of a Password leads to a information disclosure vulnerability (Password). CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. CVE summarizes:

In Lenovo Connect2 versions earlier than 4.2.5.4885 for Windows and 4.2.5.3071 for Android, when an ad-hoc connection is made between two systems for the purpose of sharing files, the password for this ad-hoc connection will be stored in a user-readable location. An attacker with read access to the user's contents could connect to the Connect2 hotspot and see the contents of files while they are being transferred between the two systems.

The bug was discovered 07/13/2017. The weakness was released 07/17/2017 (Website). The advisory is shared for download at support.lenovo.com. This vulnerability is traded as CVE-2017-3742 since 12/16/2016. The attack needs to be initiated within the local network. A authentication is needed for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 4.2.5.4885 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Lenovo

Name

• Connect2

Version

• 4.2.0
• 4.2.1
• 4.2.2
• 4.2.3
• 4.2.4
• 4.2.5

License

• commercial

Website

• Vendor: https://www.lenovo.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion