PT-2016-4839 · Intel · Intel Driver Update Utility

Published 2016-01-29 · Updated 2018-10-09 · CVE-2016-1493

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Intel Driver Update Utility versions prior to 2.4

Description The issue allows man-in-the-middle attackers to execute arbitrary code via a crafted file because driver updates are retrieved in cleartext.

Recommendations For versions prior to 2.4, update to version 2.4 or later to resolve the issue.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2016-1493

Affected Products

Intel Driver Update Utility

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-1493 · Security Note
• https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00048&languageid=en-fr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1493 · Vendor Advisory
• http://packetstormsecurity.com/files/135314/Intel-Driver-Update-Utility-2.2.0.5-Man-In-The-Middle.html · Note
• http://coresecurity.com/advisories/intel-driver-update-utility-mitm · Note
• http://seclists.org/fulldisclosure/2016/Jan/56 · Note
• http://securityfocus.com/archive/1/537327/100/0/threaded · Note