Sign-up

ID

VAR-201912-1762


CVE

CVE-2019-11088


TITLE

Intel(R) AMT Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013700

DESCRIPTION

Insufficient input validation in subsystem in Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access. Intel(R) AMT Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Trust: 1.71

sources: NVD: CVE-2019-11088 // JVNDB: JVNDB-2019-013700 // VULHUB: VHN-142699

AFFECTED PRODUCTS

vendor:intelmodel:active management technologyscope:ltversion:11.11.70

Trust: 1.8

vendor:intelmodel:active management technologyscope:ltversion:11.22.70

Trust: 1.8

vendor:intelmodel:active management technologyscope:ltversion:11.8.70

Trust: 1.8

vendor:intelmodel:active management technologyscope:ltversion:12.0.45

Trust: 1.8

vendor:intelmodel:active management technologyscope:gteversion:11.0

Trust: 1.0

vendor:intelmodel:active management technologyscope:gteversion:11.20

Trust: 1.0

vendor:intelmodel:active management technologyscope:gteversion:11.10

Trust: 1.0

vendor:intelmodel:active management technologyscope:gteversion:12.0

Trust: 1.0

sources: JVNDB: JVNDB-2019-013700 // NVD: CVE-2019-11088

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-11088
value: HIGH

Trust: 1.0

NVD: CVE-2019-11088
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201911-702
value: HIGH

Trust: 0.6

VULHUB: VHN-142699
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-11088
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-142699
severity: MEDIUM
baseScore: 5.8
vectorString: AV:A/AC:L/AU:N/C:P/I:P/A:P
accessVector: ADJACENT_NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 6.5
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-11088
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-11088
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: ADJACENT NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-142699 // JVNDB: JVNDB-2019-013700 // CNNVD: CNNVD-201911-702 // NVD: CVE-2019-11088

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-142699 // JVNDB: JVNDB-2019-013700 // NVD: CVE-2019-11088

THREAT TYPE

remote or local

Trust: 0.6

sources: CNNVD: CNNVD-201911-702

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201911-702

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-013700

PATCH
title:INTEL-SA-00241url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
Trust: 0.8
title:Intel Active Management Technology Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106240
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-013700 // 
            
            
            
            CNNVD: CNNVD-201911-702

EXTERNAL IDS
db:NVDid:CVE-2019-11088
Trust: 2.5
db:JVNid:JVNVU90354904
Trust: 0.8
db:JVNDBid:JVNDB-2019-013700
Trust: 0.8
db:LENOVOid:LEN-27716
Trust: 0.6
db:AUSCERTid:ESB-2020.2344
Trust: 0.6
db:CNNVDid:CNNVD-201911-702
Trust: 0.6
db:VULHUBid:VHN-142699
Trust: 0.1
sources:
            
            
            VULHUB: VHN-142699 // 
            
            
            
            JVNDB: JVNDB-2019-013700 // 
            
            
            
            CNNVD: CNNVD-201911-702 // 
            
            
            
            NVD: CVE-2019-11088

REFERENCES
url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11088
Trust: 0.8
url:https://jvn.jp/vu/jvnvu90354904/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-11088\
Trust: 0.8
url:https://vigilance.fr/vulnerability/intel-csme-amt-dal-sps-txe-multiple-vulnerabilities-31014
Trust: 0.6
url:https://support.lenovo.com/us/en/product_security/len-27716
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.2344/
Trust: 0.6
url:https://nvd.nist.gov/vuln/detail/cve-2019-11088
Trust: 0.6
sources:
            
            
            VULHUB: VHN-142699 // 
            
            
            
            JVNDB: JVNDB-2019-013700 // 
            
            
            
            CNNVD: CNNVD-201911-702 // 
            
            
            
            NVD: CVE-2019-11088

SOURCES
db:VULHUBid:VHN-142699
db:JVNDBid:JVNDB-2019-013700
db:CNNVDid:CNNVD-201911-702
db:NVDid:CVE-2019-11088

LAST UPDATE DATE
2024-08-14T13:12:50.880000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-142699date:2019-12-31T00:00:00
db:JVNDBid:JVNDB-2019-013700date:2020-01-15T00:00:00
db:CNNVDid:CNNVD-201911-702date:2020-07-10T00:00:00
db:NVDid:CVE-2019-11088date:2019-12-31T21:52:46.090

SOURCES RELEASE DATE
db:VULHUBid:VHN-142699date:2019-12-18T00:00:00
db:JVNDBid:JVNDB-2019-013700date:2020-01-15T00:00:00
db:CNNVDid:CNNVD-201911-702date:2019-11-12T00:00:00
db:NVDid:CVE-2019-11088date:2019-12-18T22:15:12.160