HPSBHF03557 rev. 1 - Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Remote Privilege Escalation

Potential Security Impact

Remote escalation of privilege on provisioned systems or local escalation of privilege on unprovisioned systems.

VULNERABILITY SUMMARY

A security vulnerability has been discovered in Intel’s manageability firmware that impacts all Intel OEMs. This vulnerability is a security flaw that originated in the development and deployment of Intel’s Manageability firmware. The vulnerability affects some of HP’s commercial PCs, 2 consumer PCs, workstations, thin clients, and retail point of sale products. HP’s priority and focus is on supporting our customers and ensuring the safety and security of their systems.

Intel has released a security advisory ( https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr__) as noted below:

There is an escalation of privilege vulnerability in Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology versions firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 that can allow an unprivileged attacker to gain control of the manageability features provided by these products.

There are two ways this vulnerability may be accessed, please note that Intel® Small Business Technology is not vulnerable to the first issue.

1. An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM).

2. An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

RESOLUTION

Mitigation

HP is working closely with Intel to test, validate and implement Intel’s firmware update and assist our customers in mitigation of potential risks based on a newly reported Intel vulnerability. HP’s priority and focus is on supporting our customers and ensuring the safety and security of their systems.

Please visit the following page for the most up-to-date information regarding mitigation and resolution:

<http://www.hp.com/go/intelmanageabilityissue&gt;