ID

VAR-201903-0978

CVE

CVE-2018-12196

TITLE

Intel(R) CSME Input validation vulnerability

DESCRIPTION

Insufficient input validation in Intel(R) AMT in Intel(R) CSME before version 11.8.60, 11.11.60, 11.22.60 or 12.0.20 may allow a privileged user to potentially execute arbitrary code via local access. Intel(R) CSME Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * information leak * Service operation interruption (DoS) * Privilege escalation. Intel Converged Security and Management Engine (CSME) is a security management engine of Intel Corporation. Intel AMT is one of the active management technology modules. A security vulnerability exists in Intel AMT in Intel CSME due to the program's failure to perform adequate input validation. A local attacker could exploit this vulnerability to execute arbitrary code. The following versions are affected: Intel CSME prior to 11.8.60, prior to 11.11.60, prior to 11.22.60, prior to 12.0.20

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

input validation error

CONFIGURATIONS

[
  {
    "CVE_data_version": "4.0",
    "nodes": [
      {
        "operator": "OR",
        "cpe_match": [
          {
            "vulnerable": true,
            "cpe22Uri": "cpe:/o:intel:converged_security_management_engine_firmware"
          }
        ]
      }
    ]
  }
]

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Intel ( http://www.intel.com/ ) ?? ??

SOURCES

LAST UPDATE DATE

2024-11-23T20:46:33.163000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE