Intel patches mutiple Manageability Engine vulnerabilities
Intel issued security advisories SA-00112 and SA-00118 regarding fixes for vulnerabilities in Intel Management Engine (Intel ME). A total of four vulnerabilities were fixed based on multiple announcements posted. Positive Technologies detailed these bugs, in which the “Buffer overflow in HTTP handler” problem numbered CVE-2018-3628 is the most serious.
An attacker on the same network subnet can execute arbitrary code in an Active Management Technology (AMT) environment and can access AMT accounts without administrator privileges. This flaw allows a malicious attacker to control the computer remotely.
CVE-2018-3629 is another buffer overflow vulnerability. CVE-2018-3632 is a memory corruption error that can only be exploited by local attackers with administrator privileges. CVE-2018-3627 also requires administrator privileges, which is a logical error in Intel Converged Security Management Engine 11.x that can run any malicious code.
Via: ptsecurity
