PT-2017-3132 · Intel · Intel Management Engine+3

Published 2017-11-20 · Updated 2023-05-22 · CVE-2017-5711

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Intel Manageability Engine Firmware versions 8.x through 11.20

Description The issue is related to multiple buffer overflows in Active Management Technology (AMT) that can be exploited by an attacker with local access to the system, allowing them to execute arbitrary code with AMT execution privilege. The vulnerability is also associated with the Intel Management Engine (ME) firmware of the Platform Controller Hub (PCH) family of chipsets, which acts as a southbridge.

Recommendations For Intel Manageability Engine Firmware versions 8.x through 11.20, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-02532

CVE-2017-5711

Affected Products

Active Management Technology

Intel Manageability Engine Firmware

Intel Management Engine

Platform Controller Hub

References · 10

• https://osv.dev/vulnerability/CVE-2017-5711 · Vendor Advisory
• https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02532 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-5711 · Security Note
• https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00086&languageid=en-fr · Note
• https://security.netapp.com/advisory/ntap-20171120-0001 · Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf · Note
• http://securityfocus.com/bid/101918 · Note
• https://asus.com/News/wzeltG5CjYaIwGJ0 · Note
• http://securitytracker.com/id/1039852 · Note