- Jul 22, 2014
- 2,525
Between all the new Spectre-class CPU flaws and the bugsthe company and other researchers keep finding for its Management Engine (ME) firmware, Intel can't seem to catch a break. Now the company has publicly disclosed two more ME bugs, one of which allows remote code execution on victims’ PCs.
Intel ME Threat
...
...
New Year, New Intel ME Bugs
Researchers found several ME bugs last year, and now we have two more. The first one, CVE-2018-3627, is a logic bug that may allow execution of arbitrary code on Intel-based machines. According to the Russian security company Positive Technologies, which found a similar bug in Intel MElast year, the new one is more easily exploitable, making it even more dangerous. An attacker only needs local access on a machine to be able to exploit the Intel ME.
Positive Technologies said that CVE-2018-3628, the second bug revealed by Intel, is much worse. The vulnerability enables a “full-blown remote code execution in the AMT process of the Management Engine.” Furthermore, unlike CVE-2017-5712, which PT discovered last year, an attacker wouldn’t even need an AMT administrator account.
Intel called the vulnerability a "buffer overflow in HTTP handler,” which allows remote code execution without authorization. This is what many security experts have feared in the past that Intel ME could enable. The vulnerability is similar to another ME flaw found by another researcher last year.
What Chips Are Affected
...
Intel ME Threat
...
...
New Year, New Intel ME Bugs
Researchers found several ME bugs last year, and now we have two more. The first one, CVE-2018-3627, is a logic bug that may allow execution of arbitrary code on Intel-based machines. According to the Russian security company Positive Technologies, which found a similar bug in Intel MElast year, the new one is more easily exploitable, making it even more dangerous. An attacker only needs local access on a machine to be able to exploit the Intel ME.
Positive Technologies said that CVE-2018-3628, the second bug revealed by Intel, is much worse. The vulnerability enables a “full-blown remote code execution in the AMT process of the Management Engine.” Furthermore, unlike CVE-2017-5712, which PT discovered last year, an attacker wouldn’t even need an AMT administrator account.
Intel called the vulnerability a "buffer overflow in HTTP handler,” which allows remote code execution without authorization. This is what many security experts have feared in the past that Intel ME could enable. The vulnerability is similar to another ME flaw found by another researcher last year.
What Chips Are Affected
...