Windows 10: Intel SSD Data Center Tool Vulnerability Advisory - Jan. 8

Brink · Jan 10, 2019

Intel ID: INTEL-SA-00207 Advisory Category: Software Impact of vulnerability: Escalation of Privilege Severity rating: MEDIUM Original release: 01/08/2019 Last revised: 01/08/2019
Summary:

A potential security vulnerability in the Intel® SSD Data Center Tool for Windows may enable escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-3703

Description: Improper directory permissions in the installer for the Intel(R) SSD Data Center Tool for Windows before v3.0.17 may allow authenticated users to potentially enable an escalation of privilege via local access.

CVSS Base Score: 4.5 Medium

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Affected Products:

Intel® SSD Data Center Tool for Windows before v3.0.17.

Recommendations:

Intel recommends updating to v3.0.17 or later.

Updates are available for download at this location:

https://downloadcenter.intel.com/download/28286?v=t

Acknowledgements:

Intel would like to thank SaifAllah benMassaoud for reporting this issue and working with us on coordinated disclosure.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are deployed.

Revision History

Revision Date Description 1.0 01/08/2019 Initial Release
Click to expand...

Source: INTEL-SA-00207

:)

Brink · Jan 10, 2019

Intel Parallel Studio Vulnerability Advisory

[table][tr]Intel ID: INTEL-SA-00208 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Escalation of Privilege[/td] [/tr] [tr][td]Severity rating:[/td] [td]MEDIUM[/td] [/tr] [tr][td]Original release:[/td] [td]12/11/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]12/11/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in Intel® Parallel Studio may allow for an escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability.

Vulnerability Details:

CVEID: CVE-2018-3704

Description: Improper directory permissions in the installer for the Intel(R) Parallel Studio may allow authenticated users to potentially enable an escalation of privilege via local access.

CVSS Base Score: 5.5 Medium

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L

Affected Products:

Intel® Parallel Studio before Intel® System Studio 2019 Gold.

Recommendations:

Intel recommends updating to v2019 Update 1 or later.

Updates are available for download at this location: Home | Intel® Parallel Studio XE

Acknowledgements:

Intel would like to thank Marius Gabriel Mihai for reporting this issue and working with us on coordinated disclosure.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are deployed.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]12/11/2018[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00208

Brink · Jan 10, 2019

Intel QuickAssist Technology for Linux Advisory

[table][tr]Intel ID: INTEL-SA-00209 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Denial of Service[/td] [/tr] [tr][td]Severity rating:[/td] [td]LOW[/td] [/tr] [tr][td]Original release:[/td] [td]12/11/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]12/11/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in Intel® QuickAssist Technology for Linux may allow denial of service. Intel is releasing documentation and software updates to mitigate these potential vulnerabilities.

Vulnerability Details:

CVEID: CVE-2018-12206

Description: Improper configuration of hardware access in Intel(R) QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.

CVSS Base Score: 3.2 Low

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L

CVEID: CVE-2018-18096

Description: Improper memory handling in Intel(R) QuickAssist Technology for Linux (all versions) may allow an authenticated user to potentially enable a denial of service via local access.

CVSS Base Score: 3.2 Low

CVSS Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L

Affected Products:

Intel(R) QuickAssist Technology for Linux.

Recommendations:

Intel recommends that users follow the steps below to address these issues.

For CVE-2018-12206:

Evaluate section 3.1.4 of the R4.3.0 Intel® QuickAssist for Linux Release Notes for potential changes to VM deployment environment.

Release Notes: https://01.org/sites/default/files/d...atrelnotes.pdf

For CVE-2018-18096:

Functionality removed in R4.3.

Will be reinstated with update to version R4.4 or later.

Acknowledgements:

These issues were found internally by Intel employees. Intel would like to thank Ryan Hall (CVE-2018-18096) from the DCG Red Team.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are deployed.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]12/11/2018[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00211

Brink · Jan 10, 2019

Intel System Defense Utility Vulnerability Advisory

[table][tr]Intel ID: INTEL-SA-00209 [/tr] [tr][td]Advisory Category:[/td] [td]Software[/td] [/tr] [tr][td]Impact of vulnerability:[/td] [td]Escalation of Privilege[/td] [/tr] [tr][td]Severity rating:[/td] [td]MEDIUM[/td] [/tr] [tr][td]Original release:[/td] [td]12/11/2018[/td] [/tr] [tr][td]Last revised:[/td] [td]12/11/2018[/td] [/tr] [/table]

Summary:

A potential security vulnerability in the Intel® System Defense Utility (all versions) may allow for an escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation notice for the System Defense Utility.

Vulnerability Details:

CVEID: CVE-2018-3705

Description: Improper directory permissions in the installer for the Intel(R) System Defense Utility may allow authenticated users to potentially enable an escalation of privilege via local access.

CVSS Base Score: 4.6 Medium

CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L

Affected Products:

Intel® System Defense Utility all versions

Recommendations:

Intel has issued a Product Discontinuation notice for Intel® System Defense Utility and recommends that users of the Intel® System Defense Utility uninstall it or discontinue use at their earliest convenience.

Acknowledgements:

Intel would like to thank SaifAllah benMassaoud for reporting this issue and working with us on coordinated disclosure.

Intel, and nearly the entire technology industry, follows a disclosure practice called Coordinated Disclosure, under which a cybersecurity vulnerability is generally publicly disclosed only after mitigations are deployed.

Revision History

[table][tr]Revision Date Description [/tr] [tr][td]1.0[/td] [td]12/11/2018[/td] [td]Initial Release[/td] [/tr] [/table]
Click to expand...

Source: INTEL-SA-00209

Windows 10: Intel SSD Data Center Tool Vulnerability Advisory - Jan. 8

Intel SSD Data Center Tool Vulnerability Advisory - Jan. 8

Intel SSD Data Center Tool Vulnerability Advisory - Jan. 8

Intel SSD Data Center Tool Vulnerability Advisory - Jan. 8

Intel SSD Data Center Tool Vulnerability Advisory - Jan. 8 - Similar Threads - Intel SSD Data

Intel NUC Firmware Vulnerability Advisory - Oct. 8

Intel NUC Firmware Vulnerability Advisory

Intel NUC Vulnerability Advisory

Intel Processor Diagnostic Tool Vulnerability Advisory

Intel System Support Utility for Windows Advisory - Jan. 8

Intel SGX Platform Software and Intel SGX SDK Advisory - Jan. 8

Intel PROSet/Wireless WiFi Software Advisory - Jan. 8

Intel Optane SSD DC P4800X Advisory - Jan. 8

Intel NUC Firmware Security Advisory - Jan. 8