Details of VAR-201912-1713

ID

VAR-201912-1713

CVE

CVE-2019-0166

TITLE

Intel(R) AMT Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013702

DESCRIPTION

Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via network access. Intel(R) AMT Contains an input validation vulnerability.Information may be obtained. Intel Active Management Technology (AMT) is a set of hardware-based computer remote active management technology software developed by Intel Corporation. An input validation error vulnerability exists in Intel Active Management Technology due to insufficient input validation. A local attacker could exploit this vulnerability to obtain sensitive information. The following products and versions are affected: Intel Active Management Technology versions prior to 11.8.70, versions prior to 11.11.70, versions prior to 11.22.70, and versions prior to 12.0.45

Trust: 1.71

sources: NVD: CVE-2019-0166 // JVNDB: JVNDB-2019-013702 // VULHUB: VHN-140197

AFFECTED PRODUCTS

vendor:	intel	model:	active management technology	scope:	lt	version:	11.11.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.22.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.8.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	12.0.45	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	gte	version:	11.20	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	12.0	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.10	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.0	Trust: 1.0

sources: JVNDB: JVNDB-2019-013702 // NVD: CVE-2019-0166

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-0166
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-0166
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201911-716
value:	HIGH
Trust: 0.6
VULHUB:	VHN-140197
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-0166
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-140197
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-0166
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2019-0166
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-140197 // JVNDB: JVNDB-2019-013702 // CNNVD: CNNVD-201911-716 // NVD: CVE-2019-0166

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-140197 // JVNDB: JVNDB-2019-013702 // NVD: CVE-2019-0166

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-716

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201911-716

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013702

PATCH

title:	INTEL-SA-00241	url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 0.8
title:	Intel Active Management Technology Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106340	Trust: 0.6

sources: JVNDB: JVNDB-2019-013702 // CNNVD: CNNVD-201911-716

EXTERNAL IDS

db:	NVD	id:	CVE-2019-0166	Trust: 2.5
db:	JVN	id:	JVNVU90354904	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-013702	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-716	Trust: 0.7
db:	LENOVO	id:	LEN-27716	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2344	Trust: 0.6
db:	VULHUB	id:	VHN-140197	Trust: 0.1

sources: VULHUB: VHN-140197 // JVNDB: JVNDB-2019-013702 // CNNVD: CNNVD-201911-716 // NVD: CVE-2019-0166

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0166	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu90354904/	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2019-0166\	Trust: 0.8
url:	https://vigilance.fr/vulnerability/intel-csme-amt-dal-sps-txe-multiple-vulnerabilities-31014	Trust: 0.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-0166	Trust: 0.6
url:	https://support.lenovo.com/us/en/product_security/len-27716	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2344/	Trust: 0.6

sources: VULHUB: VHN-140197 // JVNDB: JVNDB-2019-013702 // CNNVD: CNNVD-201911-716 // NVD: CVE-2019-0166

SOURCES

db:	VULHUB	id:	VHN-140197
db:	JVNDB	id:	JVNDB-2019-013702
db:	CNNVD	id:	CNNVD-201911-716
db:	NVD	id:	CVE-2019-0166

LAST UPDATE DATE

2024-11-23T19:46:38.278000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-140197	date:	2020-01-02T00:00:00
db:	JVNDB	id:	JVNDB-2019-013702	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-201911-716	date:	2020-07-10T00:00:00
db:	NVD	id:	CVE-2019-0166	date:	2024-11-21T04:16:23.620

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-140197	date:	2019-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2019-013702	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-201911-716	date:	2019-11-12T00:00:00
db:	NVD	id:	CVE-2019-0166	date:	2019-12-18T22:15:11.770