Intel Firmware Vulnerability,Intel patches remote execution

Intel’s official management technology (AMT), Intel Standard Management (ISM) and Intel Small Business (ISM), Intel’s standard management (AMT), Intel Standard Management (ISM) and Intel Small Business Firmware versions 6.x, 7.x, 8.x 9.x, 10 .x, 11.0, 11.5, and 11.6 exist in the technical release, which allows nonprivileged attackers to gain access to advanced management functions for these products, CVE Number: CVE-2017-5689. Ordinary users based on Intel PC are not affected.

Vulnerability description

There are two ways to take advantage of this vulnerability, please note that Intel Small Business technology is not susceptible to the first problem.

Unprivileged network attackers have access to system privileges to configure the Intel manageability SKU: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM).
CVSSv3 9.8 Critical / AV:N / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H

Unprivileged local attackers can provide manageability for Intel managed SKUs without privileged network or local system privileges: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT) ).
CVSSv3 8.4 High/ AV:L / AC:L / PR:N / UI:N / S:U / C:H / I:H / A:H

Affected version

Intel manageability firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6

The affected products and versions are as follows:

Zoom Telephonics, Inc 3252

BN-Mux BCW700J

BN-Mux BCW710J

BN-Mux BCW 710J2

Netgear C3000-100NAS

Netgear CGD24G-100NAS

Netgear CGD25G-1CHNAS

Netgear CM5100

Netgear CM5100-51

Castlenet CBV734EW

Castlenet CBV38Z4EC

Castlenet CBV38Z4ECNIT

Castlenet CBV383G4J

Castlenet CBV38G4J

TEKNOTEL CBW700N

CG2001-AN22A

UDBNA CG2001

UN2NA CG2001

UN2NA CG2002

UN2NA CG2200

Comtrend CM-6300n

Arris DCX-3200

Arris DG9501

Ubee DDW2600

Ubee DDW2602

Cisco DPC2100

Cisco DPC2320

Cisco DPC2420

Unaffected version

Intel manageability firmware versions 11.6

How to fix

Officials provided detailed steps to circumvent this vulnerability as follows:

Step 1:

Determine if you have Intel AMT, Intel supports the Intel SBA or ISM-enabled systems: http://ift.tt/1UaBIC0 . If you are sure that you do not have the above system, no further action is required.

Step 2:

Use “test guidelines” to assess whether the system has affected the firmware: http://ift.tt/2pBMuY1 . If you have a version in the Resolved Firmware column, you do not need to take further action to protect the system from this vulnerability.

Step 3:

Intel strongly recommends that you check the updated firmware with the system OEM. The firmware version that resolves the problem has a four-digit built-in version number that begins with “3” (XXXX.3XXX) Ex: 8.1.71.3608.

Step 4:

If you can not use the OEM firmware update, mitigation measures provided in this document are as follows: http://ift.tt/2p2dNaE

To assist with the mitigation steps provided in this document, contact Intel Customer Support ( http://ift.tt/2oR8uyL ); from the technical section , Select Intel Active Management Technology (Intel AMT).

Reference link:

http://ift.tt/2pR3HgJ

http://ift.tt/2qxkgdW

The post Intel Firmware Vulnerability appeared first on Penetration Testing in Linux. http://ift.tt/2p3wkDl http://ift.tt/2aM8QhC

Anúncios

Deixe um comentário

Preencha os seus dados abaixo ou clique em um ícone para log in:

Logotipo do WordPress.com

Você está comentando utilizando sua conta WordPress.com. Sair / Alterar )

Imagem do Twitter

Você está comentando utilizando sua conta Twitter. Sair / Alterar )

Foto do Facebook

Você está comentando utilizando sua conta Facebook. Sair / Alterar )

Foto do Google+

Você está comentando utilizando sua conta Google+. Sair / Alterar )

Conectando a %s