CVE-2008-3249
Last modified
CVE-2008-3249 is a vulnerability of currently unknown severity. The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM.. EPSS estimates a 1.30% chance of exploitation in the next 30 days.
Description
The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Thinkvantage System Update | <= 3.13.0005 |
| Lenovo | Thinkvantage System Update | 3.13 |
References
- http://secunia.com/advisories/30379Patch, Vendor Advisory
- http://secunia.com/advisories/30379Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2008-3249?
How severe is CVE-2008-3249?
How do I fix CVE-2008-3249?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2008
- CVE-2008-3243Multiple unspecified vulnerabilities in the scanning engine …
- CVE-2008-3244The scanning engine before 4.4.4 in F-Prot Antivirus before …
- CVE-2008-3245SQL injection vulnerability in phpHoo3.php in phpHoo3 4.3.9,…
- CVE-2008-3246Unspecified vulnerability in the PDF distiller component in …
- CVE-2008-3247The LDT implementation in the Linux kernel 2.6.25.x before 2…
- CVE-2008-3248qiomkfile in the Quick I/O for Database feature in Symantec …
- CVE-2008-3250SQL injection vulnerability in index.php in Arctic Issue Tra…
- CVE-2008-3251Multiple SQL injection vulnerabilities in tplSoccerSite 1.0 …
- CVE-2008-3252Stack-based buffer overflow in the read_article function in …
- CVE-2008-3253Cross-site scripting (XSS) vulnerability in the XenAPI HTTP …
- CVE-2008-3254SQL injection vulnerability in index.php in preCMS 1 allows …
- CVE-2008-3255Cross-site scripting (XSS) vulnerability in LunarNight Labor…
Are you affected by CVE-2008-3249?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST