CVE-2008-3249

Estado: ModificadaMedia (5.1)—

The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM.

CVSS

Versión: 2.0
Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P
Puntuación base: 5.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 1.30%
Percentil entre todas las CVEs puntuadas: 69
Fecha de la puntuación: 7/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Lenovo — Thinkvantage System Update

CWE

CWE-255

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2008-3249",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.1,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "HIGH",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 4.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2008-07-21T17:41:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/30379",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securitytracker.com/id?1020112",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.security-objectives.com/advisories/SECOBJADV-2008-01.txt",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/492579",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/29366",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42638",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/30379",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securitytracker.com/id?1020112",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.security-objectives.com/advisories/SECOBJADV-2008-01.txt",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/492579",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/29366",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/42638",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-255"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The client in Lenovo System Update before 3.14 does not properly validate the certificate when establishing an SSL connection, which allows remote attackers to install arbitrary packages via an SSL certificate whose X.509 headers match a public certificate used by IBM."
    },
    {
      "lang": "es",
      "value": "Cliente de actualizaciones del sistema de Lenovo anerior a la v 3.14, no valida adecuadamente los certificados cuando establece una conexión SSL, lo que permite a atacantes remotos instalar paquetes de su elección a través de un certificado SSL cuya cabecera X.509 coincide con un certificado público usado por IBM."
    }
  ],
  "lastModified": "2026-06-16T22:55:27.870",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lenovo:thinkvantage_system_update:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "310DD62B-8E91-410B-8C43-A831A6F75B99",
              "versionEndIncluding": "3.13.0005"
            },
            {
              "criteria": "cpe:2.3:a:lenovo:thinkvantage_system_update:3.13:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3804A80E-EDC6-48A9-A7D6-CA04708729DE"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}