Multiple Intel Products CVE-2017-5689 Privilege Escalation Vulnerability

Bugtraq ID:	98269
Class:	Unknown
CVE:	CVE-2017-5689
Remote:	Yes
Local:	Yes
Published:	May 01 2017 12:00AM
Updated:	Jul 19 2017 03:07PM
Credit:	Maksim Malyutin from Embedi.
Vulnerable:	Siemens SINUMERIK Panel Control Unit 0 Siemens SIMOTION P320 0 Siemens SIMATIC Industrial PC 0 Oracle MICROS Workstation 650 0 Oracle MICROS PC Workstation 2015 0 Lenovo ThinkStation S30 0 Lenovo Thinkstation P910 0 Lenovo ThinkStation P900 0 Lenovo Thinkstation P710 0 Lenovo ThinkStation P700 0 Lenovo Thinkstation P510 0 Lenovo ThinkStation P500 0 Lenovo Thinkstation P410 0 Lenovo ThinkStation P310 0 Lenovo ThinkStation P300 0 Lenovo ThinkStation E32 0 Lenovo ThinkStation E31 0 Lenovo ThinkStation E20 0 Lenovo ThinkStation D30 0 Lenovo ThinkStation C30 0 Lenovo ThinkServer TS550 0 Lenovo ThinkServer TS540 0 Lenovo ThinkServer TS440 0 Lenovo ThinkServer TS250 0 Lenovo ThinkServer TS240 0 Lenovo ThinkServer TS200v 0 Lenovo ThinkServer TS150 0 Lenovo ThinkServer TS140 0 Lenovo ThinkPad Yoga 370 0 Lenovo ThinkPad X260 0 Lenovo ThinkPad X240s 0 Lenovo ThinkPad X240 0 Lenovo ThinkPad W550s 0 Lenovo ThinkPad W530 0 Lenovo ThinkPad W520 0 Lenovo ThinkPad T560 0 Lenovo ThinkPad T550 0 Lenovo ThinkPad T470p 0 Lenovo ThinkPad T460s 0 Lenovo ThinkPad T460p 0 Lenovo ThinkPad T460 0 Lenovo ThinkPad T450s 0 Lenovo ThinkPad T440p 0 Lenovo ThinkPad T431s 0 Lenovo ThinkPad T430s 0 Lenovo ThinkPad S430 0 Lenovo ThinkPad S1 Yoga 12 0 Lenovo ThinkPad P70 0 Lenovo ThinkPad P51 0 Lenovo ThinkPad P50s 0 Lenovo ThinkPad P50 0 Lenovo ThinkPad L570 0 Lenovo ThinkPad L560 0 Lenovo ThinkPad L470 0 Lenovo ThinkPad L460 0 Lenovo Thinkcentre Merton M81 0 Lenovo ThinkCentre M93z 0 Lenovo ThinkCentre M92Z 0 Lenovo ThinkCentre M910z 0 Lenovo ThinkCentre M910x 0 Lenovo ThinkCentre M910t 0 Lenovo ThinkCentre M910s 0 Lenovo ThinkCentre M910q 0 Lenovo ThinkCentre M90z 0 Lenovo ThinkCentre M900Z 0 Lenovo ThinkCentre M900 0 Lenovo ThinkCentre M83 (Tiny) 0 Lenovo ThinkCentre M83 0 Lenovo ThinkCentre M800 0 Lenovo ThinkCentre M710q 0 Lenovo ThinkCentre M700 Tiny 0 Lenovo ThinkCentre Edge92 0 Lenovo ThinkCentre E63z (AIO) FQKT33A Intel Standard Manageability 9.5 Intel Standard Manageability 9.1 Intel Standard Manageability 9.0 Intel Standard Manageability 8.1 Intel Standard Manageability 8.0 Intel Standard Manageability 7.1 Intel Standard Manageability 7.0 Intel Standard Manageability 6.2 Intel Standard Manageability 6.1 Intel Standard Manageability 6.0 Intel Standard Manageability 11.6 Intel Standard Manageability 11.5 Intel Standard Manageability 11.0 Intel Standard Manageability 10.0 Intel Small Business Technology 9.5 Intel Small Business Technology 9.1 Intel Small Business Technology 9.0 Intel Small Business Technology 8.1 Intel Small Business Technology 8.0 Intel Small Business Technology 7.1 Intel Small Business Technology 7.0 Intel Small Business Technology 6.2 Intel Small Business Technology 6.1 Intel Small Business Technology 6.0 Intel Small Business Technology 11.6 Intel Small Business Technology 11.5 Intel Small Business Technology 11.0 Intel Small Business Technology 10.0 Intel Active Management Technology 9.5 Intel Active Management Technology 9.1 Intel Active Management Technology 9.0 Intel Active Management Technology 8.1 Intel Active Management Technology 8.0 Intel Active Management Technology 7.1 Intel Active Management Technology 7.0 Intel Active Management Technology 6.2 Intel Active Management Technology 6.1 Intel Active Management Technology 6.0 Intel Active Management Technology 11.6 Intel Active Management Technology 11.5 Intel Active Management Technology 11.0 Intel Active Management Technology 10.0
Not Vulnerable:	Intel Standard Manageability 9.5.61.3012 Intel Standard Manageability 9.1.41.3024 Intel Standard Manageability 8.1.71.3608 Intel Standard Manageability 7.1.91.3272 Intel Standard Manageability 6.2.61.3535 Intel Standard Manageability 11.6.27.3264 Intel Standard Manageability 11.0.25.3001 Intel Standard Manageability 10.0.55.3000 Intel Small Business Technology 9.5.61.3012 Intel Small Business Technology 9.1.41.3024 Intel Small Business Technology 8.1.71.3608 Intel Small Business Technology 7.1.91.3272 Intel Small Business Technology 6.2.61.3535 Intel Small Business Technology 11.6.27.3264 Intel Small Business Technology 11.0.25.3001 Intel Small Business Technology 10.0.55.3000 Intel Active Management Technology 9.5.61.3012 Intel Active Management Technology 9.1.41.3024 Intel Active Management Technology 8.1.71.3608 Intel Active Management Technology 7.1.91.3272 Intel Active Management Technology 6.2.61.3535 Intel Active Management Technology 11.6.27.3264 Intel Active Management Technology 11.0.25.3001 Intel Active Management Technology 10.0.55.3000

Multiple Intel Products CVE-2017-5689 Privilege Escalation Vulnerability

Multiple Intel products are prone to a privilege-escalation vulnerability.

An unprivileged network or local attacker can exploit this issue to gain system privileges on Intel manageability SKUs.

Multiple Intel Products CVE-2017-5689 Privilege Escalation Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Intel Products CVE-2017-5689 Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Multiple Intel Products CVE-2017-5689 Privilege Escalation Vulnerability

References:

• Intel Homepage (Intel)
  
• Advisory (ICSA-17-180-01) Siemens SIMATIC Industrial PCs, SINUMERIK Panel Contro (CERT)
  
• Intel Active Management Technology, Intel Small Business Technology, and Intel S (Intel)
  
• Intel Active Management Technology, Intel Small Business Technology, and Intel S (lenovo)
  
• Oracle Critical Patch Update Advisory - July 2017 (Oracle)
  
• SSA-874235: Intel Vulnerability in Siemens Industrial Products (Siemens)
  
• Vulnerability Note VU#491375 Intel Active Management Technology (AMT) does not p (kb.cert)