Intel AMT up to 12.0.44 Subsystem input validation

Summaryinfo

A vulnerability, which was classified as critical, was found in Intel AMT up to 12.0.44. This impacts an unknown function of the component Subsystem. Such manipulation leads to input validation. This vulnerability is traded as CVE-2019-11107. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Intel AMT up to 12.0.44. It has been rated as critical. Affected by this issue is some unknown functionality of the component Subsystem. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Insufficient input validation in the subsystem for Intel(R) AMT before version 12.0.45 may allow an unauthenticated user to potentially enable escalation of privilege via network access.

The weakness was shared 12/18/2019. This vulnerability is handled as CVE-2019-11107. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 12.0.45 eliminates this vulnerability.

The entry VDB-147468 is related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Intel

Name

• AMT

Version

• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4
• 12.0.5
• 12.0.6
• 12.0.7
• 12.0.8
• 12.0.9
• 12.0.10
• 12.0.11
• 12.0.12
• 12.0.13
• 12.0.14
• 12.0.15
• 12.0.16
• 12.0.17
• 12.0.18
• 12.0.19
• 12.0.20
• 12.0.21
• 12.0.22
• 12.0.23
• 12.0.24
• 12.0.25
• 12.0.26
• 12.0.27
• 12.0.28
• 12.0.29
• 12.0.30
• 12.0.31
• 12.0.32
• 12.0.33
• 12.0.34
• 12.0.35
• 12.0.36
• 12.0.37
• 12.0.38
• 12.0.39
• 12.0.40
• 12.0.41
• 12.0.42
• 12.0.43
• 12.0.44

License

• commercial

Website

• Vendor: https://www.intel.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion