Details of VAR-201912-1825

ID

VAR-201912-1825

CVE

CVE-2019-11108

TITLE

Intel(R) CSME Input validation vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-013667

DESCRIPTION

Insufficient input validation in subsystem for Intel(R) CSME before versions 12.0.45 and 13.0.10 may allow a privileged user to potentially enable escalation of privilege via local access. Intel(R) CSME Contains an input validation vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel Converged Security and Management Engine (CSME) is a security management engine of Intel Corporation. A security vulnerability exists in the subsystems of Intel CSME prior to 12.0.45 and prior to 13.0.10 due to insufficient input validation. A local attacker could exploit this vulnerability to elevate privileges

Trust: 1.71

sources: NVD: CVE-2019-11108 // JVNDB: JVNDB-2019-013667 // VULHUB: VHN-142721

AFFECTED PRODUCTS

vendor:	intel	model:	converged security management engine	scope:	lt	version:	12.0.45	Trust: 1.8
vendor:	intel	model:	converged security management engine	scope:	lt	version:	13.0.10	Trust: 1.8
vendor:	intel	model:	converged security management engine	scope:	gte	version:	13.0	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	gte	version:	12.0	Trust: 1.0

sources: JVNDB: JVNDB-2019-013667 // NVD: CVE-2019-11108

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-11108
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2019-11108
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201911-668
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-142721
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-11108
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-142721
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-11108
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	0.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-11108
baseSeverity:	MEDIUM
baseScore:	6.7
vectorString:	CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-142721 // JVNDB: JVNDB-2019-013667 // CNNVD: CNNVD-201911-668 // NVD: CVE-2019-11108

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-142721 // JVNDB: JVNDB-2019-013667 // NVD: CVE-2019-11108

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201911-668

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-201911-668

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013667

PATCH

title:	INTEL-SA-00241	url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 0.8
title:	Intel Converged Security and Management Engine Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=106237	Trust: 0.6

sources: JVNDB: JVNDB-2019-013667 // CNNVD: CNNVD-201911-668

EXTERNAL IDS

db:	NVD	id:	CVE-2019-11108	Trust: 2.5
db:	JVN	id:	JVNVU90354904	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-013667	Trust: 0.8
db:	CNNVD	id:	CNNVD-201911-668	Trust: 0.7
db:	LENOVO	id:	LEN-27716	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.2344	Trust: 0.6
db:	CNVD	id:	CNVD-2020-18619	Trust: 0.1
db:	VULHUB	id:	VHN-142721	Trust: 0.1

sources: VULHUB: VHN-142721 // JVNDB: JVNDB-2019-013667 // CNNVD: CNNVD-201911-668 // NVD: CVE-2019-11108

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00241.html	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-11108	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11108	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu90354904/	Trust: 0.8
url:	https://vigilance.fr/vulnerability/intel-csme-amt-dal-sps-txe-multiple-vulnerabilities-31014	Trust: 0.6
url:	https://support.lenovo.com/us/en/product_security/len-27716	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.2344/	Trust: 0.6

sources: VULHUB: VHN-142721 // JVNDB: JVNDB-2019-013667 // CNNVD: CNNVD-201911-668 // NVD: CVE-2019-11108

SOURCES

db:	VULHUB	id:	VHN-142721
db:	JVNDB	id:	JVNDB-2019-013667
db:	CNNVD	id:	CNNVD-201911-668
db:	NVD	id:	CVE-2019-11108

LAST UPDATE DATE

2024-08-14T12:07:31.477000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-142721	date:	2019-12-31T00:00:00
db:	JVNDB	id:	JVNDB-2019-013667	date:	2020-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-668	date:	2020-07-10T00:00:00
db:	NVD	id:	CVE-2019-11108	date:	2019-12-31T17:42:20.910

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-142721	date:	2019-12-18T00:00:00
db:	JVNDB	id:	JVNDB-2019-013667	date:	2020-01-14T00:00:00
db:	CNNVD	id:	CNNVD-201911-668	date:	2019-11-12T00:00:00
db:	NVD	id:	CVE-2019-11108	date:	2019-12-18T22:15:13.050