Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability
CVE-2017-5689
Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
Cos'è
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
CISA: Intel products contain a vulnerability which can allow attackers to perform privilege escalation.
Cosa fare
Apply updates per vendor instructions.
Scadenza per le agenzie federali USA: 28 luglio 2022
- Aggiunta all'elenco CISA
- 28 gennaio 2022
- Pubblicato
- 2 maggio 2017
- Gravità
- Critica 9,8 CVSS 3.1
- Probabilità di attacchi nei prossimi 30 giorni (EPSS)
- 92% tra il 0,2% più alto di tutte le vulnerabilità note
- Più dettagli
- NVD · CVE.org · CISA
Tutte le fonti (11)
- https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
- https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf
- http://www.securityfocus.com/bid/98269
- http://www.securitytracker.com/id/1038385
- https://security.netapp.com/advisory/ntap-20170509-0001/
- https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html
- https://www.embedi.com/news/mythbusters-cve-2017-5689
- https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf
Altre falle sfruttate di Intel
| Aggiunto | Vulnerabilità | Prodotto | Gravità | Probabilità di attacco |
|---|---|---|---|---|
| 10 feb 2023 | Denial-of-Service | Ethernet Diagnostics Driver for Windows | Alta 7,8 | 16% |
Fonti: Known Exploited Vulnerabilities (CISA, pubblico dominio), CVE records (cve.org) e EPSS (FIRST). La probabilità di attacco è la stima EPSS che qualcuno provi a sfruttare la falla nei prossimi 30 giorni.