Details of VAR-202006-0251

ID

VAR-202006-0251

CVE

CVE-2020-0536

TITLE

Intel(R) CSME and TXE Input verification vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2020-006827

DESCRIPTION

Improper input validation in the DAL subsystem for Intel(R) CSME versions before 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32,14.0.33 and Intel(R) TXE versions before 3.1.75 and 4.0.25 may allow an unauthenticated user to potentially enable information disclosure via network access. Intel(R) CSME and TXE There is an input verification vulnerability in.Information may be obtained. Both Intel Converged Security and Management Engine (CSME) and Intel TXE are products of Intel Corporation of the United States. Intel Converged Security and Management Engine is a security management engine. Intel TXE is a trusted execution engine with hardware authentication function used in CPU (Central Processing Unit). An input validation error vulnerability exists in the DAL subsystem in Intel CSME and TXE. An attacker could exploit this vulnerability to obtain sensitive information. The following products and versions are affected: Intel CSME before 11.8.77, before 11.12.77, before 11.22.77, before 12.0.64, before 13.0.32, before 14.0.33; before Intel TXE3.1.75 Version, version before 4.0.25

Trust: 1.71

sources: NVD: CVE-2020-0536 // JVNDB: JVNDB-2020-006827 // VULHUB: VHN-161970

AFFECTED PRODUCTS

vendor:	intel	model:	converged security management engine	scope:	lt	version:	11.8.77	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	lt	version:	11.22.77	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	lt	version:	13.0.32	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	gte	version:	14.0	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	gte	version:	13.0	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	lt	version:	12.0.64	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	gte	version:	11.10	Trust: 1.0
vendor:	intel	model:	trusted execution engine	scope:	gte	version:	3.0	Trust: 1.0
vendor:	intel	model:	trusted execution engine	scope:	lt	version:	4.0.25	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	lt	version:	11.12.77	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	gte	version:	11.20	Trust: 1.0
vendor:	intel	model:	trusted execution engine	scope:	gte	version:	4.0	Trust: 1.0
vendor:	intel	model:	trusted execution engine	scope:	lt	version:	3.1.75	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	gte	version:	12.0	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	lt	version:	14.0.33	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	gte	version:	11.0	Trust: 1.0
vendor:	intel	model:	converged security management engine	scope:	eq	version:	11.12.77	Trust: 0.8
vendor:	intel	model:	converged security management engine	scope:	eq	version:	11.22.77	Trust: 0.8
vendor:	intel	model:	converged security management engine	scope:	eq	version:	11.8.77	Trust: 0.8
vendor:	intel	model:	converged security management engine	scope:	eq	version:	12.0.64	Trust: 0.8
vendor:	intel	model:	converged security management engine	scope:	eq	version:	13.0.32	Trust: 0.8
vendor:	intel	model:	converged security management engine	scope:	eq	version:	14.0.33	Trust: 0.8
vendor:	intel	model:	trusted execution engine	scope:	eq	version:	3.1.75	Trust: 0.8
vendor:	intel	model:	trusted execution engine	scope:	eq	version:	4.0.25	Trust: 0.8

sources: JVNDB: JVNDB-2020-006827 // NVD: CVE-2020-0536

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-0536
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-006827
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202006-727
value:	HIGH
Trust: 0.6
VULHUB:	VHN-161970
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-0536
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-006827
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
VULHUB:	VHN-161970
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-0536
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-006827
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-161970 // JVNDB: JVNDB-2020-006827 // CNNVD: CNNVD-202006-727 // NVD: CVE-2020-0536

PROBLEMTYPE DATA

problemtype:

CWE-20

Trust: 1.9

sources: VULHUB: VHN-161970 // JVNDB: JVNDB-2020-006827 // NVD: CVE-2020-0536

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202006-727

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202006-727

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-006827

PATCH

title:	INTEL-SA-00295	url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html	Trust: 0.8
title:	Intel CSME and TXE Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=122454	Trust: 0.6

sources: JVNDB: JVNDB-2020-006827 // CNNVD: CNNVD-202006-727

EXTERNAL IDS

db:	NVD	id:	CVE-2020-0536	Trust: 2.5
db:	LENOVO	id:	LEN-30041	Trust: 1.7
db:	JVN	id:	JVNVU98979613	Trust: 0.8
db:	JVNDB	id:	JVNDB-2020-006827	Trust: 0.8
db:	CNNVD	id:	CNNVD-202006-727	Trust: 0.7
db:	AUSCERT	id:	ESB-2020.1991.2	Trust: 0.6
db:	AUSCERT	id:	ESB-2020.1991	Trust: 0.6
db:	VULHUB	id:	VHN-161970	Trust: 0.1

sources: VULHUB: VHN-161970 // JVNDB: JVNDB-2020-006827 // CNNVD: CNNVD-202006-727 // NVD: CVE-2020-0536

REFERENCES

url:	https://security.netapp.com/advisory/ntap-20200611-0006/	Trust: 1.7
url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00295.html	Trust: 1.7
url:	https://support.lenovo.com/de/en/product_security/len-30041	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2020-0536	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-0536	Trust: 0.8
url:	https://jvn.jp/vu/jvnvu98979613/	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2020.1991/	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.1991.2/	Trust: 0.6
url:	https://vigilance.fr/vulnerability/intel-csme-sps-txe-amt-ism-dal-multiple-vulnerabilities-32545	Trust: 0.6
url:	https://support.lenovo.com/us/en/product_security/len-30041	Trust: 0.6

sources: VULHUB: VHN-161970 // JVNDB: JVNDB-2020-006827 // CNNVD: CNNVD-202006-727 // NVD: CVE-2020-0536

SOURCES

db:	VULHUB	id:	VHN-161970
db:	JVNDB	id:	JVNDB-2020-006827
db:	CNNVD	id:	CNNVD-202006-727
db:	NVD	id:	CVE-2020-0536

LAST UPDATE DATE

2024-11-23T19:42:33.747000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-161970	date:	2020-07-22T00:00:00
db:	JVNDB	id:	JVNDB-2020-006827	date:	2020-07-20T00:00:00
db:	CNNVD	id:	CNNVD-202006-727	date:	2021-05-24T00:00:00
db:	NVD	id:	CVE-2020-0536	date:	2024-11-21T04:53:41.603

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-161970	date:	2020-06-15T00:00:00
db:	JVNDB	id:	JVNDB-2020-006827	date:	2020-07-20T00:00:00
db:	CNNVD	id:	CNNVD-202006-727	date:	2020-06-09T00:00:00
db:	NVD	id:	CVE-2020-0536	date:	2020-06-15T14:15:10.783