Η Lenovo confirmed that the software automaticς σύνδεσης Fingerprint Manager Pro (έκδοση 8.01.86), το οποίο επιτρέπει στους users to unlock their devices using fingerprint recognition is affected by a serious vulnerability.
Attackers could exploit the loophole security to access any system equipped with the application.
According to Lenovo's disclosure, Fingerprint Manager contained a hardcoded code that could connect users locally to non-administrator accounts.
In addition to the hardcoded code, the "security" application stored sensitive information such as Windows login credentials and fingerprints that it "encrypted using a weak algorithm".
Vulnerability was discovered by security compass researcher Jackson Thuraisamy.
https://www.youtube.com/watch?v=JRA34PzvANg
The faulty software is available for Windows 7, 8 and 8.1. According to the details published on its website companys, below are all the devices that use Fingerprint Manager:
- ThinkPad L560
- ThinkPad P40 Yoga, P50s
- ThinkPad T440, T440p, T440s, T450, T450s, T460, T540p, T550, T560
- ThinkPad W540, W541, W550s
- ThinkPad X1 Carbon (Type 20A7, 20A8), X1 Carbon (Type 20BS, 20BT)
- ThinkPad X240, X240s, X250, X260
- ThinkPad Yoga 14 (20FY), Yoga 460
- ThinkCentre M73, M73z, M78, M79, M83, M93, M93p, M93z
- ThinkStation E32, P300, P500, P700, P900
Those of you who have any of the above devices, and the version of Fingerprint Manager Pro is 8.01.86 are advised to update immediately to version 8.01.87 or a newer version. You can do it from the following link:
https://pcsupport.lenovο.com/downloads/ds034486
Information, header image: TNW
