Details of VAR-201912-1716

ID

VAR-201912-1716

CVE

CVE-2019-0131

TITLE

Intel(R) AMT Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013728

DESCRIPTION

Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable denial of service or information disclosure via adjacent access. Intel(R) AMT Contains an input validation vulnerability.Information is obtained and service operation is interrupted (DoS) There is a possibility of being put into a state. Intel Active Management Technology (AMT) is a set of hardware-based computer remote active management technology software developed by Intel Corporation. An input validation error vulnerability exists in Intel Active Management Technology due to insufficient input validation. An attacker could exploit this vulnerability to cause a denial of service or obtain sensitive information. The following products and versions are affected: Intel Active Management Technology versions prior to 11.8.70, versions prior to 11.11.70, versions prior to 11.22.70, and versions prior to 12.0.45

Trust: 1.71

sources: NVD: CVE-2019-0131 // JVNDB: JVNDB-2019-013728 // VULHUB: VHN-140162

AFFECTED PRODUCTS

vendor:	intel	model:	active management technology	scope:	lt	version:	11.11.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.22.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.8.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	12.0.45	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	gte	version:	11.20	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	12.0	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.10	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.0	Trust: 1.0

sources: JVNDB: JVNDB-2019-013728 // NVD: CVE-2019-0131

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-0131
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-0131
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201911-721
value:	HIGH
Trust: 0.6
VULHUB:	VHN-140162
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-0131
severity:	MEDIUM
baseScore:	4.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-140162
severity:	MEDIUM
baseScore:	4.8
vectorString:	AV:A/AC:L/AU:N/C:P/I:N/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	6.5
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-0131
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	5.2
version:	3.1
Trust: 1.0
NVD:	CVE-2019-0131
baseSeverity:	HIGH
baseScore:	8.1
vectorString:	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
attackVector:	ADJACENT NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-140162 // JVNDB: JVNDB-2019-013728 // CNNVD: CNNVD-201911-721 // NVD: CVE-2019-0131

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-140162 // JVNDB: JVNDB-2019-013728 // NVD: CVE-2019-0131

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201911-721

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201911-721

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013728

PATCH

title:	INTEL-SA-00241	url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 0.8
title:	Intel Active Management Technology Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106342	Trust: 0.6

sources: JVNDB: JVNDB-2019-013728 // CNNVD: CNNVD-201911-721

EXTERNAL IDS

db:	NVD	id:	CVE-2019-0131	Trust: 2.5
db:	JVN	id:	JVNVU90354904	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-013728	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-721	Trust: 0.7
db:	LENOVO	id:	LEN-27716	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2344	Trust: 0.6
db:	VULHUB	id:	VHN-140162	Trust: 0.1

sources: VULHUB: VHN-140162 // JVNDB: JVNDB-2019-013728 // CNNVD: CNNVD-201911-721 // NVD: CVE-2019-0131

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-0131	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-0131	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu90354904/	Trust: 0.8
url:	https://vigilance.fr/vulnerability/intel-csme-amt-dal-sps-txe-multiple-vulnerabilities-31014	Trust: 0.6
url:	https://support.lenovo.com/us/en/product_security/len-27716	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2344/	Trust: 0.6

sources: VULHUB: VHN-140162 // JVNDB: JVNDB-2019-013728 // CNNVD: CNNVD-201911-721 // NVD: CVE-2019-0131

SOURCES

db:	VULHUB	id:	VHN-140162
db:	JVNDB	id:	JVNDB-2019-013728
db:	CNNVD	id:	CNNVD-201911-721
db:	NVD	id:	CVE-2019-0131

LAST UPDATE DATE

2024-11-23T19:48:35.571000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-140162	date:	2020-01-02T00:00:00
db:	JVNDB	id:	JVNDB-2019-013728	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-201911-721	date:	2020-07-10T00:00:00
db:	NVD	id:	CVE-2019-0131	date:	2024-11-21T04:16:18.103

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-140162	date:	2019-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2019-013728	date:	2020-01-15T00:00:00
db:	CNNVD	id:	CNNVD-201911-721	date:	2019-11-12T00:00:00
db:	NVD	id:	CVE-2019-0131	date:	2019-12-18T22:15:11.533