CVE-2018-3616
First published: Tue Sep 11 2018(Updated: )
Bleichenbacher-style side channel vulnerability in TLS implementation in Intel Active Management Technology before 12.0.5 may allow an unauthenticated user to potentially obtain the TLS session key via the network.
Credit: secure@intel.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Intel Converged Security and Management Engine | >=11.0.0<12.0.5 | |
| Intel Active Management Technology | <12.0.5 | |
| Intel Manageability Engine Firmware | >=9.0.0.0<11.0 | |
| Siemens Simatic Field PG M5 | <22.01.06 | |
| Siemens Simatic Field PG M5 | ||
| Siemens Simatic IPC427E Firmware | <21.01.09 | |
| Siemens Simatic IPC427E Firmware | ||
| Siemens Simatic IPC477E Firmware | <21.01.09 | |
| Siemens Simatic IPC477E Firmware | ||
| Siemens Simatic IPC547E | <r1.30.0 | |
| Siemens Simatic IPC547E | ||
| Siemens Simatic IPC547G Firmware | <r1.23.0 | |
| Siemens Simatic IPC547G Firmware | ||
| Siemens SIMATIC IPC Firmware | <19.02.11 | |
| Siemens SIMATIC IPC627D Firmware | ||
| Siemens SIMATIC IPC647D | <19.01.14 | |
| Siemens SIMATIC IPC647D Firmware | ||
| Siemens SIMATIC IPC677D Firmware | <19.02.11 | |
| Siemens SIMATIC IPC677D Firmware | ||
| Siemens SIMATIC IPC827D | <19.02.11 | |
| Siemens SIMATIC IPC827D Firmware | ||
| Siemens SIMATIC IPC847D Firmware | <19.01.14 | |
| Siemens SIMATIC IPC847D Firmware | ||
| Siemens Simatic ITP1000 | <23.01.04 | |
| Siemens Simatic ITP1000 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/106996
- https://cert-portal.siemens.com/productcert/pdf/ssa-377318.pdf
- https://ics-cert.us-cert.gov/advisories/ICSA-19-043-05
- https://security.netapp.com/advisory/ntap-20180924-0003/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03876en_us
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00141.html
Frequently Asked Questions
What is CVE-2018-3616?
CVE-2018-3616 is a Bleichenbacher-style side channel vulnerability in the TLS implementation in Intel Active Management Technology before 12.0.5.
How can an unauthenticated user exploit CVE-2018-3616?
An unauthenticated user can potentially obtain the TLS session key via the network.
Which software versions are affected by CVE-2018-3616?
Intel Active Management Technology firmware versions before 12.0.5 are affected.
What is the severity of CVE-2018-3616?
CVE-2018-3616 has a severity rating of 5.9 (medium).
Where can I find more information about CVE-2018-3616?
More information about CVE-2018-3616 can be found at the following references: [1] [2] [3].
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- vendor/intel
- canonical/intel converged security and management engine
- version/intel converged security and management engine/11.0.0
- canonical/intel active management technology
- canonical/intel manageability engine firmware
- version/intel manageability engine firmware/9.0.0.0
- vendor/siemens
- canonical/siemens simatic field pg m5
- canonical/siemens simatic ipc427e firmware
- canonical/siemens simatic ipc477e firmware
- canonical/siemens simatic ipc547e
- canonical/siemens simatic ipc547g firmware
- canonical/siemens simatic ipc firmware
- canonical/siemens simatic ipc627d firmware
- canonical/siemens simatic ipc647d
- canonical/siemens simatic ipc647d firmware
- canonical/siemens simatic ipc677d firmware
- canonical/siemens simatic ipc827d
- canonical/siemens simatic ipc827d firmware
- canonical/siemens simatic ipc847d firmware
- canonical/siemens simatic itp1000
- canonical/siemens simatic itp1000 firmware