Intel Active Management - Authentication Bypass
ID: CVE-2017-5689
Severity: critical
Author: pdteam
Tags: cve2017,cve,amt,intel,tenable,kev
Description
Section titled “Description”Intel Active Management platforms are susceptible to authentication bypass. A non-privileged network attacker can gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability. A non-privileged local attacker can provision manageability features, gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology. The issue has been observed in versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 for all three platforms. Versions before 6 and after 11.6 are not impacted.
YAML Source
Section titled “YAML Source”id: CVE-2017-5689
info: name: Intel Active Management - Authentication Bypass author: pdteam severity: critical description: | Intel Active Management platforms are susceptible to authentication bypass. A non-privileged network attacker can gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability. A non-privileged local attacker can provision manageability features, gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology, Intel Standard Manageability, and Intel Small Business Technology. The issue has been observed in versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 for all three platforms. Versions before 6 and after 11.6 are not impacted. impact: | An attacker can bypass authentication and gain unauthorized access to the Intel Active Management firmware, potentially leading to unauthorized control of the affected system. remediation: | Update the Intel Active Management firmware to version 11.6.55, 11.7.55, 11.11.55, 11.0.25, 8.1.71, or 7.1.91 to mitigate the vulnerability. reference: - https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr - https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability - https://www.embedi.com/news/mythbusters-cve-2017-5689 - https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf - https://nvd.nist.gov/vuln/detail/cve-2017-5689 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2017-5689 epss-score: 0.97395 epss-percentile: 0.99912 cpe: cpe:2.3:o:intel:active_management_technology_firmware:6.0:*:*:*:*:*:*:* metadata: verified: true max-request: 2 vendor: intel product: active_management_technology_firmware shodan-query: - title:"Active Management Technology" - http.title:"active management technology" fofa-query: title="active management technology" google-query: intitle:"active management technology" tags: cve2017,cve,amt,intel,tenable,kev
http: - raw: - | GET / HTTP/1.1 Host: {{Hostname}} - | GET /hw-sys.htm HTTP/1.1 Host: {{Hostname}}
digest-username: admin
matchers-condition: and matchers: - type: word part: body_2 words: - "System Status" - "Active Management Technology" condition: and
- type: status status: - 200# digest: 490a0046304402207de1a3526a954e9869eeef7c07b76c1d71b18d54ccab71a6e7c57bfbec52f3ea02205464503890363c122f101c9e64b6b2fce175819c9953206ff029e9a07b5813c9:922c64590222798bb761d5b6d8e72950Guide to check the vulnerabilities
Section titled “Guide to check the vulnerabilities”This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.
$ nuclei -u "URL" -t "http/cves/2017/CVE-2017-5689.yaml"