Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-3616

Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.

Published

2018-09-12T19:29:02.403

Last Modified

2024-11-21T04:05:46.667

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	intel	converged_security_management_engine_firmware	< 12.0.5	Yes
Operating System	intel	active_management_technology_firmware	< 12.0.5	Yes
Operating System	intel	manageability_engine_firmware	< 11.0	Yes
Operating System	siemens	simatic_field_pg_m5_firmware	< 22.01.06	Yes
Hardware	siemens	simatic_field_pg_m5	-	No
Operating System	siemens	simatic_ipc427e_firmware	< 21.01.09	Yes
Hardware	siemens	simatic_ipc427e	-	No
Operating System	siemens	simatic_ipc477e_firmware	< 21.01.09	Yes
Hardware	siemens	simatic_ipc477e	-	No
Operating System	siemens	simatic_ipc547e_firmware	< r1.30.0	Yes
Hardware	siemens	simatic_pc547e	-	No
Operating System	siemens	simatic_pc547g_firmware	< r1.23.0	Yes
Hardware	siemens	simatic_ipc547g	-	No
Operating System	siemens	simatic_ipc627d_firmware	< 19.02.11	Yes
Hardware	siemens	simatic_ipc627d	-	No
Operating System	siemens	simatic_ipc647d_firmware	< 19.01.14	Yes
Hardware	siemens	simatic_ipc647d	-	No
Operating System	siemens	simatic_ipc677d_firmware	< 19.02.11	Yes
Hardware	siemens	simatic_ipc677d	-	No
Operating System	siemens	simatic_ipc827d_firmware	< 19.02.11	Yes
Hardware	siemens	simatic_ipc827d	-	No
Operating System	siemens	simatic_ipc847d_firmware	< 19.01.14	Yes
Hardware	siemens	simatic_ipc847d	-	No
Operating System	siemens	simatic_itp1000_firmware	< 23.01.04	Yes
Hardware	siemens	simatic_itp1000	-	No

References

http://www.securityfocus.com/bid/106996 Third Party Advisory, VDB Entry ([email protected])
https://cert-portal.siemens.com/productcert/pdf/ssa-377318.pdf Patch, Third Party Advisory ([email protected])
https://ics-cert.us-cert.gov/advisories/ICSA-19-043-05 Third Party Advisory, US Government Resource ([email protected])
https://security.netapp.com/advisory/ntap-20180924-0003/ Third Party Advisory ([email protected])
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03876en_us Third Party Advisory ([email protected])
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00141.html Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/106996 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://cert-portal.siemens.com/productcert/pdf/ssa-377318.pdf Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://ics-cert.us-cert.gov/advisories/ICSA-19-043-05 Third Party Advisory, US Government Resource (af854a3a-2127-422b-91ae-364da2661108)
https://security.netapp.com/advisory/ntap-20180924-0003/ Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03876en_us Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00141.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)