Skip to content
  • Home
  • About
  • Services
    • Vulnerability and Threat Intelligence
    • Threat Modeling and Risk Assessment
    • Penetration Testing
    • Source Code Review
    • Security Research
    • Security Consulting
  • Training
    • Kernel exploitation
      • Training – November 2019 – CLOSED
    • Kernel development
    • Userland exploitation
  • Labs
    • Exploits
    • Publications
    • Security Alerts
      • Latest Security Alerts
      • Latest Modified Security Alerts
      • Latest Ordered Security Alerts
      • Search Security Alert
  • Blog
  • Contact
  • Language
    • English
    • Português

Allele Security Intelligence

Efficient information security services

ASA-2019-00348 – Intel Open Cloud Integrity Technology (Open CIT) and Intel OpenAttestation: Relative path traversal in the login routine

Posted on June 13, 2019June 13, 2019 by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2019-00348

Identifier(s)

ASA-2019-00348, CVE-2019-0182, INTEL-SA-00248

Title

Relative path traversal in the login routine

Vendor(s)

Intel

Product(s)

Intel Open Cloud Integrity Technology (Open CIT)
Intel OpenAttestation

Affected version(s)

All versions of Intel Open Cloud Integrity Technology (Open CIT) and OpenAttestation

Fixed version(s)

Intel recommends users of Intel Open Cloud Integrity Technology (Open CIT) and OpenAttestation discontinue use and move to Intel® Security Libraries for Data Center (Intel® SecL-DC).

Proof of concept

Unknown

Description

Relative path traversal in the login routine for Open Cloud Integrity Technology (Open CIT) and OpenAttestation may allow an authenticated user to potentially enable escalation of privilege via local access.

Technical details

Unknown

Credits

Unknown

Reference(s)

Open Cloud Integrity Technology and OpenAttestation Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00248.html

Intel® Security Libraries for Data Center (Intel® SecL-DC)
https://01.org/intel-secl

CVE-2019-0182
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0182

CVE-2019-0182
https://nvd.nist.gov/vuln/detail/CVE-2019-0182

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: June 13, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.

Share this:

  • Click to print (Opens in new window)
  • Click to email a link to a friend (Opens in new window)
  • Click to share on Facebook (Opens in new window)
  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Twitter (Opens in new window)
  • Click to share on Pocket (Opens in new window)
  • Click to share on Telegram (Opens in new window)
  • Click to share on WhatsApp (Opens in new window)

Like this:

Like Loading...

Related

Tagged ASA-2019-00348, Authenticated User, CVE-2019-0182, Intel, Intel Open CIT, Intel Open Cloud Integrity Technology, Intel OpenAttestation, INTEL-SA-00248, Local Access, Login Routine, Privilege Escalation, Relative Path Traversal

Post navigation

Previous Post ASA-2019-00347 – Intel Open Cloud Integrity Technology (Open CIT) and Intel OpenAttestation: Improper input validation in the database
Next Post ASA-2019-00349 – Intel Open Cloud Integrity Technology (Open CIT): Insufficient password handling in the login routine

Archives

  • September 2020 (10)
  • May 2020 (1)
  • March 2020 (1)
  • February 2020 (5)
  • December 2019 (33)
  • November 2019 (28)
  • October 2019 (54)
  • September 2019 (25)
  • August 2019 (46)
  • July 2019 (77)
  • June 2019 (95)
  • May 2019 (68)
  • April 2019 (77)
  • March 2019 (49)
  • February 2019 (78)
  • January 2019 (36)
  • December 2018 (38)
  • November 2018 (44)
  • October 2018 (20)
  • September 2018 (1)
  • August 2018 (1)

Tags

Apache HTTP Server (13) Apache Software Foundation (19) Arbitrary Code Execution (43) Arbitrary File Read (7) Authenticated User (13) Authentication Bypass (7) BIND (9) BIOS (9) Buffer Overflow (24) Code Execution (11) Command Injection (9) Cross-Site Request Forgery (13) Cross-Site Scripting (42) Cross-Site Scripting (XSS) (49) CSRF (12) curl (11) Das U-Boot (13) Denial of Service (DoS) (113) Deserialization (8) Facebook (11) Firmware (8) FreeBSD (24) Git (9) GitLab (15) Gitlab Community Edition (12) Gitlab Enterprise Edition (13) Go (7) Heap Buffer Overflow (23) IBM (13) IBM Sterling B2B Integrator Standard Edition (7) Improper Permissions (9) Information Disclosure (64) Integer Overflow (20) Intel (40) INTEL-SA-00248 (9) INTEL-SA-00264 (7) Intel Computer Card (7) Intel Computer Stick (7) Intel NUC (10) Intel Open CIT (8) Intel Open Cloud Integrity Technology (8) Jenkins (46) Joomla (10) Kubernetes (12) libssh2 (9) Linux (34) Linux Kernel (46) Local Access (27) MacOS (10) Magento (40) Memory Corruption (23) Memory Leak (13) mfsa2019-21 (21) MFSA2019-22 (6) MikroTik (10) MikroTik RouterOS (8) Mozilla (20) Mozilla Firefox (22) Mozilla Firefox ESR (8) Mozilla Thunderbird (11) NFS (7) NGINX (8) NULL Pointer Dereference (10) OpenBSD (11) OpenSSL (13) Out-Of-Bounds Read (41) Out-Of-Bounds Write (25) PIA (9) Private Internet Access (9) Privilege Escalation (99) Race Condition (12) rdesktop (19) Remote Code Execution (RCE) (64) rubygems (7) Samba (15) Sandbox Bypass (8) Security Bypass (8) Side Channel (8) SQL Injection (7) Stack Buffer Overflow (10) Stored Cross-Site Scripting (14) systemd (7) TCP (10) TYPO3 (32) TYPO3 CMS (7) Unbounded memcpy (7) Use-After-Free (28) VMware (25) VMware ESXI (9) VMware Fusion (8) VMware Workstation (9) WebKit (20) WebKitGTK (20) WhatsApp (9) Windows (12) Wind River (11) Wind River VxWorks (11) WPE Webkit (20) WSA-2019-0003 (20) Xen (8)
  • Twitter
  • Facebook
  • Github
  • Linkedin
  • RSS

Services

Vulnerability and Threat Intelligence

Threat Modeling and Risk Assessment

Penetration Testing

Source Code Review

Security Research

Security Consulting

Training

Kernel exploitation

Kernel development

Userland exploitation

Publications

Redução da superfície de ataque ao kernel do Linux – SEMCOMP 2019

Introdução à pesquisa em vulnerabilidades no núcleo do Linux – EnSI 2018

Introdução à pesquisa em vulnerabilidades no núcleo do Linux – RoadSec Salvador 2018

Rootkits em kernel space – Redshift, um rootkit para o kernel do FreeBSD

Public proofs of concept

CVE-2012-0217

CVE-2012-4576

latest security alerts

  • ASA-2020-00051 – Linux kernel: vsyscall page refcounting error September 16, 2020
  • ASA-2020-00050 – Linux kernel: Use-after-free vulnerability in cgroup BPF component September 16, 2020
  • ASA-2020-00049 – Linux kernel: Kernel stack information leak on s390/s390x platform September 12, 2020

Subscribe to our Blog

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

© 2020 Allele Security Intelligence.
All rights reserved. Privacy Policy.

%d bloggers like this: