9.8Kritisch
KEV
CVE-2017-5689Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
Bekannt ausgenutzt — Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability
CISA hat am 28.01.2022 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 28.07.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-5689
Beschreibung
An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).
Schwachstellentyp (CWE):
CWE-269
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
Referenzen und Patches
- https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability Technical DescriptionThird Party Advisory
- https://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdf Broken Link
- 98269 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- 1038385 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
- https://security.netapp.com/advisory/ntap-20170509-0001/ Third Party Advisory
- https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf Broken LinkExploitTechnical DescriptionThird Party Advisory
- https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr PatchVendor Advisory
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_us Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.html PatchThird Party Advisory
- https://www.embedi.com/news/mythbusters-cve-2017-5689 Broken LinkThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdf Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5689 US Government Resource
CPE-Treffer (NVD) (54)
cpe:2.3:o:hpe:proliant_ml10_gen9_server_firmware:5.0:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_itp1000_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc847d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc847c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_ipc827d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc827c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc677c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_ipc647d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc647c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc627c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_ipc547g_firmware:*:*:*:*:*:*:*:*< 11.0.26.3000cpe:2.3:o:siemens:simatic_ipc547e_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc547d_firmware:*:*:*:*:*:*:*:*< 7.1.91.3272cpe:2.3:o:siemens:simatic_ipc477e_firmware:*:*:*:*:*:*:*:*< 21.01.05cpe:2.3:o:siemens:simatic_ipc477d_firmware:-:*:*:*:-:*:*:*cpe:2.3:o:siemens:simatic_ipc477d_firmware:-:*:*:*:pro:*:*:*cpe:2.3:o:siemens:simatic_field_pg_m3_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_field_pg_m4_firmware:*:*:*:*:*:*:*:*< 18.01.06cpe:2.3:o:siemens:simatic_field_pg_m5_firmware:*:*:*:*:*:*:*:*< 22.01.03cpe:2.3:o:siemens:simatic_ipc627d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_ipc677d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_pcs_7_ipc427e_firmware:*:*:*:*:*:*:*:*< 21.01.04cpe:2.3:o:siemens:simatic_pcs_7_ipc547d_firmware:*:*:*:*:*:*:*:*< 7.1.91.3272cpe:2.3:o:siemens:simatic_pcs_7_ipc547e_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_pcs_7_ipc547g_firmware:*:*:*:*:*:*:*:*< 11.0.26.3000cpe:2.3:o:siemens:simatic_pcs_7_ipc627c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_pcs_7_ipc677c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_pcs_7_ipc647c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_pcs_7_ipc647d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_pcs_7_ipc847c_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:siemens:simatic_pcs_7_ipc847d_firmware:*:*:*:*:*:*:*:*< 9.1.41.3024cpe:2.3:o:siemens:simatic_pcs_7_ipc427e_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_pcs_7_ipc547g_firmware:*:*:*:*:*:*:*:*< 11.0.26.3000cpe:2.3:o:siemens:simatic_pcs_7_ipc477d_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_ipc427d_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:siemens:simatic_ipc427e_firmware:*:*:*:*:*:*:*:*< 21.01.05cpe:2.3:o:siemens:simotion_p320-4_s_firmware:*:*:*:*:*:*:*:*< 17.02.06.83.1cpe:2.3:o:siemens:sinumerik_pcu50.5-p_firmware:*:*:*:*:*:*:*:*< 6.2.61.3535cpe:2.3:o:intel:active_management_technology_firmware:6.0:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:6.1:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:6.2:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:7.0:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:7.1:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:8.0:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:8.1:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:9.0:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:9.1:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:9.5:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:10.0:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:11.0:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:11.5:*:*:*:*:*:*:*cpe:2.3:o:intel:active_management_technology_firmware:11.6:*:*:*:*:*:*:*