Sign-up

ID

VAR-201912-1822


CVE

CVE-2019-11107


TITLE

Intel(R) AMT Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013666

DESCRIPTION

Insufficient input validation in the subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via network access. Intel(R) AMT Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel Active Management Technology ( AMT ) is the US Intel ( Intel ) company's set of hardware-based computer remote active management technology software. An attacker could exploit this vulnerability to elevate privileges

Trust: 1.71

sources: NVD: CVE-2019-11107 // JVNDB: JVNDB-2019-013666 // VULHUB: VHN-142720

AFFECTED PRODUCTS

vendor:intelmodel:active management technologyscope:ltversion:12.0.45

Trust: 1.8

vendor:intelmodel:active management technologyscope:gteversion:12.0

Trust: 1.0

sources: JVNDB: JVNDB-2019-013666 // NVD: CVE-2019-11107

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-11107
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-11107
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201911-672
value: CRITICAL

Trust: 0.6

VULHUB: VHN-142720
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-11107
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-142720
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-11107
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2019-11107
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-142720 // JVNDB: JVNDB-2019-013666 // CNNVD: CNNVD-201911-672 // NVD: CVE-2019-11107

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-142720 // JVNDB: JVNDB-2019-013666 // NVD: CVE-2019-11107

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-672

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201911-672

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-013666

PATCH
title:INTEL-SA-00241url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
Trust: 0.8
title:Intel Active Management Technology Enter the fix for the verification error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106329
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-013666 // 
            
            
            
            CNNVD: CNNVD-201911-672

EXTERNAL IDS
db:NVDid:CVE-2019-11107
Trust: 2.5
db:JVNid:JVNVU90354904
Trust: 0.8
db:JVNDBid:JVNDB-2019-013666
Trust: 0.8
db:CNNVDid:CNNVD-201911-672
Trust: 0.7
db:LENOVOid:LEN-27716
Trust: 0.6
db:AUSCERTid:ESB-2020.2344
Trust: 0.6
db:VULHUBid:VHN-142720
Trust: 0.1
sources:
            
            
            VULHUB: VHN-142720 // 
            
            
            
            JVNDB: JVNDB-2019-013666 // 
            
            
            
            CNNVD: CNNVD-201911-672 // 
            
            
            
            NVD: CVE-2019-11107

REFERENCES
url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-11107
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11107
Trust: 0.8
url:https://jvn.jp/vu/jvnvu90354904/
Trust: 0.8
url:https://vigilance.fr/vulnerability/intel-csme-amt-dal-sps-txe-multiple-vulnerabilities-31014
Trust: 0.6
url:https://support.lenovo.com/us/en/product_security/len-27716
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2020.2344/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-142720 // 
            
            
            
            JVNDB: JVNDB-2019-013666 // 
            
            
            
            CNNVD: CNNVD-201911-672 // 
            
            
            
            NVD: CVE-2019-11107

SOURCES
db:VULHUBid:VHN-142720
db:JVNDBid:JVNDB-2019-013666
db:CNNVDid:CNNVD-201911-672
db:NVDid:CVE-2019-11107

LAST UPDATE DATE
2024-11-23T20:22:37.543000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-142720date:2020-01-02T00:00:00
db:JVNDBid:JVNDB-2019-013666date:2020-01-14T00:00:00
db:CNNVDid:CNNVD-201911-672date:2020-07-10T00:00:00
db:NVDid:CVE-2019-11107date:2024-11-21T04:20:33.030

SOURCES RELEASE DATE
db:VULHUBid:VHN-142720date:2019-12-18T00:00:00
db:JVNDBid:JVNDB-2019-013666date:2020-01-14T00:00:00
db:CNNVDid:CNNVD-201911-672date:2019-11-12T00:00:00
db:NVDid:CVE-2019-11107date:2019-12-18T22:15:12.957