Sign-up

ID

VAR-201905-1250


CVE

CVE-2019-11094


TITLE

Intel Multiple vulnerabilities in the product

Trust: 0.8

sources: JVNDB: JVNDB-2019-003441

DESCRIPTION

Insufficient input validation in system firmware for Intel (R) NUC Kit may allow an authenticated user to potentially enable escalation of privilege, denial of service, and/or information disclosure via local access. Intel NUC Kit is a small desktop computer produced by Intel Corporation of the United States. The vulnerability stems from the failure of the network system or product to properly validate the input data

Trust: 1.8

sources: NVD: CVE-2019-11094 // JVNDB: JVNDB-2019-004711 // VULHUB: VHN-142706 // VULMON: CVE-2019-11094

AFFECTED PRODUCTS

vendor:intelmodel:nuc kitscope:eqversion: -

Trust: 1.0

vendor:intelmodel:acu wizardscope: - version: -

Trust: 0.8

vendor:intelmodel:active management technologyscope: - version: -

Trust: 0.8

vendor:intelmodel:converged security management enginescope: - version: -

Trust: 0.8

vendor:intelmodel:driver and support assistantscope: - version: -

Trust: 0.8

vendor:intelmodel:dynamic application loaderscope: - version: -

Trust: 0.8

vendor:intelmodel:i915scope: - version: -

Trust: 0.8

vendor:intelmodel:nuc board nuc7i7dnbescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc7i5dnhescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc7i7dnhescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc7i7dnkescope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc8i7hnkscope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kit nuc8i7hvkscope: - version: -

Trust: 0.8

vendor:intelmodel:proset/wireless software driverscope: - version: -

Trust: 0.8

vendor:intelmodel:quartus ii programmer and toolsscope: - version: -

Trust: 0.8

vendor:intelmodel:server platform servicesscope: - version: -

Trust: 0.8

vendor:intelmodel:trusted execution enginescope: - version: -

Trust: 0.8

vendor:intelmodel:intelscope: - version: -

Trust: 0.8

vendor:intelmodel:quartus primescope: - version: -

Trust: 0.8

vendor:intelmodel:scs discovery utilityscope: - version: -

Trust: 0.8

vendor:intelmodel:unite clientscope: - version: -

Trust: 0.8

vendor:intelmodel:graphics driverscope: - version: -

Trust: 0.8

vendor:intelmodel:nuc kitscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2019-003441 // JVNDB: JVNDB-2019-004711 // NVD: CVE-2019-11094

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-11094
value: HIGH

Trust: 1.0

NVD: CVE-2019-11094
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201905-765
value: HIGH

Trust: 0.6

VULHUB: VHN-142706
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-11094
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-11094
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-142706
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-11094
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-142706 // VULMON: CVE-2019-11094 // JVNDB: JVNDB-2019-004711 // CNNVD: CNNVD-201905-765 // NVD: CVE-2019-11094

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-142706 // JVNDB: JVNDB-2019-004711 // NVD: CVE-2019-11094

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201905-765

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201905-765

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-003441

PATCH
title:INTEL-SA-00234 - IntelR SCS Discovery Utility and IntelR ACU Wizard Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00234.html
Trust: 0.8
title:INTEL-SA-00244 - IntelR QuartusR Software Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00244.html
Trust: 0.8
title:INTEL-SA-00245 - Intel UniteR Client for Android* Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00245.html
Trust: 0.8
title:INTEL-SA-00204 - Intel IntelR PROSet/Wireless WiFi Software Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00204.html
Trust: 0.8
title:INTEL-SA-00249 - IntelR i915 Graphics for Linux Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00249.html
Trust: 0.8
title:INTEL-SA-00213 - IntelR CSME, IntelR SPS, IntelR TXE, IntelR DAL, and IntelR AMT 2019.1 QSR Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00213.html
Trust: 0.8
title:INTEL-SA-00251 - IntelR NUC Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00251.html
Trust: 0.8
title:INTEL-SA-00218 - IntelR Graphics Driver for Windows* 2019.1 QSR Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00218.html
Trust: 0.8
title:INTEL-SA-00252 - IntelR Driver & Support Assistant Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00252.html
Trust: 0.8
title:INTEL-SA-00223 - Intel 2019.1 QSR UEFI Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00223.html
Trust: 0.8
title:INTEL-SA-00228 - Intel UniteR Client Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00228.html
Trust: 0.8
title:INTEL-SA-00233 - Microarchitectural Data Sampling Advisoryurl:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.html
Trust: 0.8
title:INTEL-SA-00251url:https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00251.html
Trust: 0.8
title:Threatposturl:https://threatpost.com/intel-patches-high-severity-flaw-in-processor-diagnostic-tool/146352/
Trust: 0.1
title:Threatposturl:https://threatpost.com/intel-patches-nuc-firmware/145620/
Trust: 0.1
title:Threatposturl:https://threatpost.com/intel-fixes-critical-high-severity-flaws-across-several-products/144940/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-11094 // 
            
            
            
            JVNDB: JVNDB-2019-003441 // 
            
            
            
            JVNDB: JVNDB-2019-004711

EXTERNAL IDS
db:NVDid:CVE-2019-11094
Trust: 2.6
db:JVNid:JVNVU92328381
Trust: 1.6
db:JVNDBid:JVNDB-2019-003441
Trust: 1.6
db:JVNDBid:JVNDB-2019-004711
Trust: 0.8
db:CNNVDid:CNNVD-201905-765
Trust: 0.7
db:VULHUBid:VHN-142706
Trust: 0.1
db:VULMONid:CVE-2019-11094
Trust: 0.1
sources:
            
            
            VULHUB: VHN-142706 // 
            
            
            
            VULMON: CVE-2019-11094 // 
            
            
            
            JVNDB: JVNDB-2019-003441 // 
            
            
            
            JVNDB: JVNDB-2019-004711 // 
            
            
            
            CNNVD: CNNVD-201905-765 // 
            
            
            
            NVD: CVE-2019-11094

REFERENCES
url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00251.html
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-11094
Trust: 1.4
url:https://jvn.jp/vu/jvnvu92328381/index.html
Trust: 0.8
url:https://mdsattacks.com/files/ridl.pdf
Trust: 0.8
url:https://mdsattacks.com/files/fallout.pdf
Trust: 0.8
url:https://zombieloadattack.com/
Trust: 0.8
url:https://www.intel.com/content/www/us/en/architecture-and-technology/mds.html
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11094
Trust: 0.8
url:https://jvn.jp/vu/jvnvu92328381/
Trust: 0.8
url:https://jvndb.jvn.jp/ja/contents/2019/jvndb-2019-003441.html
Trust: 0.8
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/intel-patches-high-severity-flaw-in-processor-diagnostic-tool/146352/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-142706 // 
            
            
            
            VULMON: CVE-2019-11094 // 
            
            
            
            JVNDB: JVNDB-2019-003441 // 
            
            
            
            JVNDB: JVNDB-2019-004711 // 
            
            
            
            CNNVD: CNNVD-201905-765 // 
            
            
            
            NVD: CVE-2019-11094

SOURCES
db:VULHUBid:VHN-142706
db:VULMONid:CVE-2019-11094
db:JVNDBid:JVNDB-2019-003441
db:JVNDBid:JVNDB-2019-004711
db:CNNVDid:CNNVD-201905-765
db:NVDid:CVE-2019-11094

LAST UPDATE DATE
2024-11-23T19:54:31.086000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-142706date:2019-05-21T00:00:00
db:VULMONid:CVE-2019-11094date:2019-05-21T00:00:00
db:JVNDBid:JVNDB-2019-003441date:2019-05-16T00:00:00
db:JVNDBid:JVNDB-2019-004711date:2019-06-06T00:00:00
db:CNNVDid:CNNVD-201905-765date:2019-05-28T00:00:00
db:NVDid:CVE-2019-11094date:2024-11-21T04:20:31.577

SOURCES RELEASE DATE
db:VULHUBid:VHN-142706date:2019-05-17T00:00:00
db:VULMONid:CVE-2019-11094date:2019-05-17T00:00:00
db:JVNDBid:JVNDB-2019-003441date:2019-05-16T00:00:00
db:JVNDBid:JVNDB-2019-004711date:2019-06-06T00:00:00
db:CNNVDid:CNNVD-201905-765date:2019-05-17T00:00:00
db:NVDid:CVE-2019-11094date:2019-05-17T16:29:03.187