CVE-2018-3616

Published: Sep 12, 2018Modified: Nov 21, 2024

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.

Affected (14)

Products: Intel: Active Management Technology Firmware, Converged Security Management Engine Firmware, Manageability Engine Firmware · Siemens: Simatic Field Pg M5 Firmware, Simatic Ipc427e Firmware, Simatic Ipc477e Firmware, Simatic Ipc547e Firmware, Simatic Pc547g Firmware, Simatic Ipc627d Firmware, Simatic Ipc647d Firmware, Simatic Ipc677d Firmware, Simatic Ipc827d Firmware, Simatic Ipc847d Firmware, Simatic Itp1000 Firmware

Intel

3 products

Active Management Technology Firmware

Converged Security Management Engine Firmware

Manageability Engine Firmware

Siemens

11 products

Simatic Field Pg M5 Firmware

Simatic Ipc427e Firmware

Simatic Ipc477e Firmware

Simatic Ipc547e Firmware

Simatic Pc547g Firmware

Simatic Ipc627d Firmware

Simatic Ipc647d Firmware

Simatic Ipc677d Firmware

Simatic Ipc827d Firmware

Simatic Ipc847d Firmware

Simatic Itp1000 Firmware

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Intel Active Management Technology Firmware	Before 12.0.5
Intel Converged Security Management Engine Firmware	From 11.0.0 to 12.0.5
Intel Manageability Engine Firmware	From 9.0.0.0 to 11.0

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Field Pg M5 Firmware	Before 22.01.06

Running on/with	Platform Versions
Siemens Simatic Field Pg M5	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc427e Firmware	Before 21.01.09

Running on/with	Platform Versions
Siemens Simatic Ipc427e	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc477e Firmware	Before 21.01.09

Running on/with	Platform Versions
Siemens Simatic Ipc477e	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc547e Firmware	Before r1.30.0

Running on/with	Platform Versions
Siemens Simatic Pc547e	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Pc547g Firmware	Before r1.23.0

Running on/with	Platform Versions
Siemens Simatic Ipc547g	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc627d Firmware	Before 19.02.11

Running on/with	Platform Versions
Siemens Simatic Ipc627d	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc647d Firmware	Before 19.01.14

Running on/with	Platform Versions
Siemens Simatic Ipc647d	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc677d Firmware	Before 19.02.11

Running on/with	Platform Versions
Siemens Simatic Ipc677d	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc827d Firmware	Before 19.02.11

Running on/with	Platform Versions
Siemens Simatic Ipc827d	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Ipc847d Firmware	Before 19.01.14

Running on/with	Platform Versions
Siemens Simatic Ipc847d	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Simatic Itp1000 Firmware	Before 23.01.04

Running on/with	Platform Versions
Siemens Simatic Itp1000	All versions

References (12)

http://www.securityfocus.com/bid/106996

Source: secure@intel.com

Third Party AdvisoryVDB Entry

https://cert-portal.siemens.com/productcert/pdf/ssa-377318.pdf

Source: secure@intel.com

PatchThird Party Advisory

https://ics-cert.us-cert.gov/advisories/ICSA-19-043-05

Source: secure@intel.com

Third Party AdvisoryUS Government Resource

https://security.netapp.com/advisory/ntap-20180924-0003/

Source: secure@intel.com

Third Party Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03876en_us

Source: secure@intel.com

Third Party Advisory

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00141.html

Source: secure@intel.com

Vendor Advisory

http://www.securityfocus.com/bid/106996