Windows 10: Intel RAID Web Console 2 Vulnerability Advisory

Brink · Aug 13, 2019

Intel ID: INTEL-SA-00246 Advisory Category: Software Impact of vulnerability: Information Disclosure Severity rating: MEDIUM Original release: 08/13/2019 Last revised: 08/13/2019
Summary:

Intel has identified a potential vulnerability in the Intel® RAID Web Console 2 (RWC2). Intel has issued a Product Discontinuation notice for RWC2. Intel recommends that users uninstall Intel® RWC2, then install RAID Web Console 3 (RWC3).

Vulnerability Details:

CVEID: CVE-2019-0173
Description: Authentication bypass in the web console for Intel(R) Raid Web Console 2 all versions may allow an unauthenticated attacker to potentially enable disclosure of information via network access.
CVSS Base Score: 6.8 Medium
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H

Affected Products:

Intel(R) RAID Web Console 2 all versions.

Recommendations:

Intel recommends that users uninstall Intel® RAID Web Console 2, then install RAID Web Console 3 version 7.009.011.000 or later.

Intel® RAID Web Console 3 is available for download at this location: Download Intel(R) RAID Web Console 3 for Windows*

Acknowledgements:

Intel would like to thank trotmaster99 for reporting this issue.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

Revision History

Revision Date Description 1.0 08/13/2019 Initial Release
Click to expand...

Source: INTEL-SA-00246

:)

Brink · Aug 13, 2019

Intel RAID Web Console 3 (RWC3) for Windows Advisory

[table][tr]Intel ID: INTEL-SA-00259 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Escalation of Privilege[/td] [/tr] [tr][td]Severity rating:[/td] [td]HIGH[/td] [/tr] [tr][td]Original release:[/td] [td]06/11/2019[/td] [/tr] [tr][td]Last revised:[/td] [td]06/11/2019[/td] [/tr] [/table]

Summary:

A potential security vulnerability in the Intel® RAID Web Console 3 (RWC3) for Windows* may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2019-11119
Description: Insufficient session validation in the service API for Intel(R) RWC3 version 4.186 and before may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVSS Base Score: 8.9 High
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:H

Affected Products:

Intel® RAID Web Console 3 for Windows* version 4.186 and before.

Recommendations:

Intel recommends that users of Intel® RAID Web Console 3 for Windows* update to 7.009.011.000 or later.

Updates are available for download at this location:

Download Intel(R) RAID Web Console 3 for Windows*

Acknowledgements:

The following issue was found internally by Intel employees. Intel would like to thank Alexander Gutkin.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are available.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]06/11/2019[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00259

Brink · Aug 13, 2019

Intel RAID Web Server 3 Service Advisory for security vulnerability

[table][tr]Intel ID: INTEL-SA-00171 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Information Disclosure[/td] [/tr] [tr][td]Severity rating:[/td] [td]MEDIUM[/td] [/tr] [tr][td]Original release:[/td] [td]10/09/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]10/09/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in the Intel® Raid Web Server 3 may allow information disclosure. Intel is releasing software updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-12161

Description: Insufficient session validation in the webserver component of the Intel(R) Rapid Web Server 3 may allow an unauthenticated user to potentially disclose information via network access.

CVSS Base Score: 5.3 Medium

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Affected Products:

Intel® RAID Web Console for Windows version 3 and before.

Recommendations:

Intel recommends that users of Intel® RAID Web Console for Windows update to version 4.186 or later.

Updates are available for download at this location: https://downloadcenter.intel.com/dow...3-for-Windows-

Acknowledgements:

Intel would like to thank Trotmaster for reporting this issue and working with us on coordinated disclosure.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]10/09/2018[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00171

Brink · Aug 13, 2019

Intel Parallel Studio Vulnerability Advisory

[table][tr]Intel ID: INTEL-SA-00208 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Escalation of Privilege[/td] [/tr] [tr][td]Severity rating:[/td] [td]MEDIUM[/td] [/tr] [tr][td]Original release:[/td] [td]12/11/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]12/11/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in Intel® Parallel Studio may allow for an escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-3704

Description: Improper directory permissions in the installer for the Intel(R) Parallel Studio may allow authenticated users to potentially enable an escalation of privilege via local access.

CVSS Base Score: 5.5 Medium

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L

Affected Products:

Intel® Parallel Studio before Intel® System Studio 2019 Gold.

Recommendations:

Intel recommends updating to v2019 Update 1 or later.

Updates are available for download at this location: Home | Intel® Parallel Studio XE

Acknowledgements:

Intel would like to thank Marius Gabriel Mihai for reporting this issue and working with us on coordinated disclosure.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are deployed.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]12/11/2018[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00208

Windows 10: Intel RAID Web Console 2 Vulnerability Advisory

Intel RAID Web Console 2 Vulnerability Advisory

Intel RAID Web Console 2 Vulnerability Advisory

Intel RAID Web Console 2 Vulnerability Advisory

Intel RAID Web Console 2 Vulnerability Advisory - Similar Threads - Intel RAID Web

Intel NUC Firmware Vulnerability Advisory

Intel Computing Improvement Program Vulnerability Advisory

Intel Driver and Support Assistant Vulnerability Advisory

Intel NUC Vulnerability Advisory

Intel Processor Diagnostic Tool Vulnerability Advisory

Intel RAID Web Console 3 (RWC3) for Windows Advisory

Intel System Defense Utility Vulnerability Advisory

Intel Parallel Studio Vulnerability Advisory

Intel RAID Web Server 3 Service Advisory for security vulnerability

Users found this page by searching for:

raid web console 2 windows