CVE-2018-3616 Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key vi...
MediumCVSS 5.9
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| intel converged security management engine firmware | >= 11.0.0, < 12.0.5 | 12.0.5 |
| intel active management technology firmware | < 12.0.5 | 12.0.5 |
| intel manageability engine firmware | >= 9.0.0.0, < 11.0 | 11.0 |
| Siemens simatic field pg m5 firmware | < 22.01.06 | 22.01.06 |
| Siemens simatic ipc427e firmware | < 21.01.09 | 21.01.09 |
| Siemens simatic ipc477e firmware | < 21.01.09 | 21.01.09 |
| Siemens simatic ipc547e firmware | < r1.30.0 | r1.30.0 |
| Siemens simatic pc547g firmware | < r1.23.0 | r1.23.0 |
| Siemens simatic ipc627d firmware | < 19.02.11 | 19.02.11 |
| Siemens simatic ipc647d firmware | < 19.01.14 | 19.01.14 |
| Siemens simatic ipc677d firmware | < 19.02.11 | 19.02.11 |
| Siemens simatic ipc827d firmware | < 19.02.11 | 19.02.11 |
| Siemens simatic ipc847d firmware | < 19.01.14 | 19.01.14 |
| Siemens simatic itp1000 firmware | < 23.01.04 | 23.01.04 |
| Intel(R) Active Management Technology | = Versions before 12.0.5. | No fix listed |
References
- 106996 third-party-advisory vdb-entry
- cert-portal.siemens.com patch third-party-advisory
- ics-cert.us-cert.gov third-party-advisory us-government-resource
- security.netapp.com third-party-advisory
- support.hpe.com third-party-advisory
- www.intel.com vendor-advisory