Multiple vulnerabilities in Intel Data Center Manager SDK

1) Improper authentication

EUVDB-ID: #VU17789

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0102

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows an adjacent unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient session authentication in web server for Intel(R) Data Center Manager SDK. An adjacent attacker can gain elevated privileges.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU17791

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0103

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to insufficient file protection in install routine for Intel(R) Data Center Manager SDK. A local attacker can gain access to important data.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Information disclosure

EUVDB-ID: #VU17792

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0104

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to insufficient file protection in uninstall routine for Intel(R) Data Center Manager SDK. A local attacker can gain access to important data.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Privilege escalation

EUVDB-ID: #VU17793

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0105

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient file permissions checking in install routine for Intel(R) Data Center Manager SDK. A remote attacker can trick the victim into processing a specially crafted input and gain elevated privileges to conduct further attacks.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Privilege escalation

EUVDB-ID: #VU17794

Risk: Low

CVSSv3.1: 5.2 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0106

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient run protection in install routine for Intel(R) Data Center Manager SDK. A local attacker can gain elevated privileges to conduct further attacks.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Privilege escalation

EUVDB-ID: #VU17795

Risk: Low

CVSSv3.1: 5.8 [CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0107

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The weakness exists due to insufficient user prompt in install routine for Intel(R) Data Center Manager SDK. A local attacker can gain elevated privileges to conduct further attacks.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Information disclosure

EUVDB-ID: #VU17796

Risk: Low

CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0108

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper file permissions for Intel(R) Data Center Manager SDK. A local attacker can gain access to arbitrary data.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Privilege escalation

EUVDB-ID: #VU17797

Risk: Low

CVSSv3.1: 4.6 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0109

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to gain elevated privileges on the target system.

The weakness exists due to improper folder permissions in Intel(R) Data Center Manager SDK. A local attacker can gain elevated privileges to conduct further attacks.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU17798

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0110

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to insufficient key management for Intel(R) Data Center Manager SDK. A local attacker can gain access to important data.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Information disclosure

EUVDB-ID: #VU17799

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0111

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local authenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper file permissions for Intel(R) Data Center Manager SDK. A local attacker can gain access to important data.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improper input validation

EUVDB-ID: #VU17800

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-0112

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper flow control in crypto routines for Intel(R) Data Center Manager SDK. A remote attacker can trick the victim into processing a specially crafted input and cause the service to crash.

Mitigation

Update to version 5.0.2.

Vulnerable software versions

Data Center Manager SDK: 5.0.0 - 5.0.1

External links

http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00215.html

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.