Details of VAR-201912-1815

ID

VAR-201912-1815

CVE

CVE-2019-11100

TITLE

Intel(R) AMT Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013688

DESCRIPTION

Insufficient input validation in the subsystem for Intel(R) AMT before versions 11.8.70, 11.11.70, 11.22.70 and 12.0.45 may allow an unauthenticated user to potentially enable information disclosure via physical access. Intel(R) AMT Contains an input validation vulnerability.Information may be obtained. Intel Active Management Technology (AMT) is a set of hardware-based computer remote active management technology software developed by Intel Corporation. An attacker in physical proximity could exploit this vulnerability to disclose information. The following products and versions are affected: Intel AMT versions prior to 11.8.70, versions prior to 11.11.70, versions prior to 11.22.70, and versions prior to 12.0.45

Trust: 1.71

sources: NVD: CVE-2019-11100 // JVNDB: JVNDB-2019-013688 // VULHUB: VHN-142713

AFFECTED PRODUCTS

vendor:	intel	model:	active management technology	scope:	lt	version:	11.11.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.22.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	11.8.70	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	lt	version:	12.0.45	Trust: 1.8
vendor:	intel	model:	active management technology	scope:	gte	version:	11.20	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	12.0	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.10	Trust: 1.0
vendor:	intel	model:	active management technology	scope:	gte	version:	11.0	Trust: 1.0

sources: JVNDB: JVNDB-2019-013688 // NVD: CVE-2019-11100

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-11100
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-11100
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201911-690
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-142713
value:	LOW
Trust: 0.1

nvd@nist.gov:	CVE-2019-11100
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-142713
severity:	LOW
baseScore:	2.1
vectorString:	AV:L/AC:L/AU:N/C:P/I:N/A:N
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-11100
baseSeverity:	MEDIUM
baseScore:	4.6
vectorString:	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	0.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2019-11100
baseSeverity:	MEDIUM
baseScore:	4.6
vectorString:	CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	PHYSICAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-142713 // JVNDB: JVNDB-2019-013688 // CNNVD: CNNVD-201911-690 // NVD: CVE-2019-11100

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-142713 // JVNDB: JVNDB-2019-013688 // NVD: CVE-2019-11100

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201911-690

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013688

PATCH

title:	INTEL-SA-00241	url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 0.8
title:	Intel Active Management Technology Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106334	Trust: 0.6

sources: JVNDB: JVNDB-2019-013688 // CNNVD: CNNVD-201911-690

EXTERNAL IDS

db:	NVD	id:	CVE-2019-11100	Trust: 2.5
db:	JVN	id:	JVNVU90354904	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-013688	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-690	Trust: 0.7
db:	LENOVO	id:	LEN-27716	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2344	Trust: 0.6
db:	VULHUB	id:	VHN-142713	Trust: 0.1

sources: VULHUB: VHN-142713 // JVNDB: JVNDB-2019-013688 // CNNVD: CNNVD-201911-690 // NVD: CVE-2019-11100

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-11100	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11100	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu90354904/	Trust: 0.8
url:	https://vigilance.fr/vulnerability/intel-csme-amt-dal-sps-txe-multiple-vulnerabilities-31014	Trust: 0.6
url:	https://support.lenovo.com/us/en/product_security/len-27716	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2344/	Trust: 0.6

sources: VULHUB: VHN-142713 // JVNDB: JVNDB-2019-013688 // CNNVD: CNNVD-201911-690 // NVD: CVE-2019-11100

SOURCES

db:	VULHUB	id:	VHN-142713
db:	JVNDB	id:	JVNDB-2019-013688
db:	CNNVD	id:	CNNVD-201911-690
db:	NVD	id:	CVE-2019-11100

LAST UPDATE DATE

2024-11-23T20:39:57.190000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-142713	date:	2020-01-02T00:00:00
db:	JVNDB	id:	JVNDB-2019-013688	date:	2020-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-690	date:	2020-07-10T00:00:00
db:	NVD	id:	CVE-2019-11100	date:	2024-11-21T04:20:32.197

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-142713	date:	2019-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2019-013688	date:	2020-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-690	date:	2019-11-12T00:00:00
db:	NVD	id:	CVE-2019-11100	date:	2019-12-18T22:15:12.410