Details of VAR-200912-0369

ID

VAR-200912-0369

CVE

CVE-2009-4419

TITLE

SINIT Authenticated Code Module (ACM) of Intel Q35 Vulnerability that can be obtained authority

Trust: 0.8

sources: JVNDB: JVNDB-2009-005232

DESCRIPTION

Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets in the SINIT Authenticated Code Module (ACM), which allows local users to bypass the Trusted Execution Technology protection mechanism and gain privileges by modifying the MCHBAR register to point to an attacker-controlled region, which prevents the SENTER instruction from properly applying VT-d protection while an MLE is being loaded. Intel BIOS is prone to an unspecified privilege-escalation vulnerability. Successful exploits will allow local processes to bypass intended security restrictions and gain elevated privileges. Currently very few technical details are available. We will update this BID as more information emerges. Intel Trusted Execution Technology is a hardware extension technology in Intel Core 2 Duo processor E8400, designed to protect data in a virtualized computing environment from software attacks, virus intrusions and other types of threats. ---------------------------------------------------------------------- Do you have VARM strategy implemented? (Vulnerability Assessment Remediation Management) If not, then implement it through the most reliable vulnerability intelligence source on the market. Implement it through Secunia. For more information visit: http://secunia.com/advisories/business_solutions/ Alternatively request a call from a Secunia representative today to discuss how we can help you with our capabilities contact us at: sales@secunia.com ---------------------------------------------------------------------- TITLE: Intel Trusted Execution Technology SINIT Security Bypass SECUNIA ADVISORY ID: SA37900 VERIFY ADVISORY: http://secunia.com/advisories/37900/ DESCRIPTION: A vulnerability has been reported in multiple Intel products, which can be exploited by malicious, local users to bypass certain security restrictions and gain escalated privileges. The vulnerability is caused due to a configuration error in the SINIT Authenticated Code Module (ACM). The vulnerability is reported in platforms using the Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets. SOLUTION: Install updated SINIT modules. http://sourceforge.net/projects/tboot/files/ Q35: Install Q35_SINIT_18.BIN. GM45 and PM45 Express: Install GM45_GS45_PM45_SINIT_21.BIN. Q45 and Q43 Express: Install Q45_Q43_SINIT_18.BIN. PROVIDED AND/OR DISCOVERED BY: The vendor credits Alexander Tereshkin, Rafal Wojtczuk, and Joanna Rutkowska from Invisible Things Lab. ORIGINAL ADVISORY: http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00021&languageid=en-fr ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2009-4419 // JVNDB: JVNDB-2009-005232 // BID: 37430 // VULHUB: VHN-41865 // PACKETSTORM: 84169

AFFECTED PRODUCTS

vendor:	intel	model:	gm45 chipset	scope:	-	version:	-	Trust: 1.4
vendor:	intel	model:	pm45 express chipset	scope:	-	version:	-	Trust: 1.4
vendor:	intel	model:	q35 chipset	scope:	-	version:	-	Trust: 1.4
vendor:	intel	model:	q43 express chipset	scope:	-	version:	-	Trust: 1.4
vendor:	intel	model:	q45 chipset	scope:	-	version:	-	Trust: 1.4
vendor:	intel	model:	gm45 chipset	scope:	eq	version:	*	Trust: 1.0
vendor:	intel	model:	q43 express chipset	scope:	eq	version:	*	Trust: 1.0
vendor:	intel	model:	q35 chipset	scope:	eq	version:	*	Trust: 1.0
vendor:	intel	model:	q45 chipset	scope:	eq	version:	*	Trust: 1.0
vendor:	intel	model:	pm45 express chipset	scope:	eq	version:	*	Trust: 1.0
vendor:	intel	model:	q45	scope:	eq	version:	0	Trust: 0.3
vendor:	intel	model:	q43 express	scope:	eq	version:	0	Trust: 0.3
vendor:	intel	model:	q35	scope:	eq	version:	0	Trust: 0.3
vendor:	intel	model:	pm45 express	scope:	eq	version:	0	Trust: 0.3
vendor:	intel	model:	gm45	scope:	eq	version:	0	Trust: 0.3

sources: BID: 37430 // JVNDB: JVNDB-2009-005232 // CNNVD: CNNVD-200912-352 // NVD: CVE-2009-4419

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2009-4419
value:	HIGH
Trust: 1.0
NVD:	CVE-2009-4419
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200912-352
value:	HIGH
Trust: 0.6
VULHUB:	VHN-41865
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2009-4419
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-41865
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-41865 // JVNDB: JVNDB-2009-005232 // CNNVD: CNNVD-200912-352 // NVD: CVE-2009-4419

PROBLEMTYPE DATA

problemtype:

CWE-16

Trust: 1.9

sources: VULHUB: VHN-41865 // JVNDB: JVNDB-2009-005232 // NVD: CVE-2009-4419

THREAT TYPE

local

Trust: 1.0

sources: BID: 37430 // PACKETSTORM: 84169 // CNNVD: CNNVD-200912-352

TYPE

configuration error

Trust: 0.6

sources: CNNVD: CNNVD-200912-352

CONFIGURATIONS

sources: JVNDB: JVNDB-2009-005232

PATCH

title:

INTEL-SA-00021

url:

http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00021&languageid=en-fr

Trust: 0.8

sources: JVNDB: JVNDB-2009-005232

EXTERNAL IDS

db:	NVD	id:	CVE-2009-4419	Trust: 2.5
db:	BID	id:	37430	Trust: 2.0
db:	SECUNIA	id:	37900	Trust: 1.8
db:	VUPEN	id:	ADV-2009-3618	Trust: 1.7
db:	OSVDB	id:	61248	Trust: 1.7
db:	SECTRACK	id:	1023382	Trust: 1.7
db:	JVNDB	id:	JVNDB-2009-005232	Trust: 0.8
db:	CNNVD	id:	CNNVD-200912-352	Trust: 0.7
db:	XF	id:	54963	Trust: 0.6
db:	VULHUB	id:	VHN-41865	Trust: 0.1
db:	PACKETSTORM	id:	84169	Trust: 0.1

sources: VULHUB: VHN-41865 // BID: 37430 // JVNDB: JVNDB-2009-005232 // PACKETSTORM: 84169 // CNNVD: CNNVD-200912-352 // NVD: CVE-2009-4419

REFERENCES

url:	http://security-center.intel.com/advisory.aspx?intelid=intel-sa-00021&languageid=en-fr	Trust: 2.0
url:	http://www.securityfocus.com/bid/37430	Trust: 1.7
url:	http://invisiblethingslab.com/resources/misc09/another%20txt%20attack.pdf	Trust: 1.7
url:	http://theinvisiblethings.blogspot.com/2009/12/another-txt-attack.html	Trust: 1.7
url:	http://osvdb.org/61248	Trust: 1.7
url:	http://www.securitytracker.com/id?1023382	Trust: 1.7
url:	http://secunia.com/advisories/37900	Trust: 1.7
url:	http://www.vupen.com/english/advisories/2009/3618	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/54963	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-4419	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-4419	Trust: 0.8
url:	http://xforce.iss.net/xforce/xfdb/54963	Trust: 0.6
url:	http://www.intel.com/	Trust: 0.3
url:	http://security-center.intel.com/advisory.aspx?intelid=intel-sa-00021&languageid=en-fr	Trust: 0.1
url:	http://secunia.com/advisories/37900/	Trust: 0.1
url:	http://secunia.com/advisories/secunia_security_advisories/	Trust: 0.1
url:	http://sourceforge.net/projects/tboot/files/	Trust: 0.1
url:	http://secunia.com/advisories/business_solutions/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/advisories/about_secunia_advisories/	Trust: 0.1

sources: VULHUB: VHN-41865 // BID: 37430 // JVNDB: JVNDB-2009-005232 // PACKETSTORM: 84169 // CNNVD: CNNVD-200912-352 // NVD: CVE-2009-4419

CREDITS

Alexander Tereshkin

Trust: 0.6

sources: CNNVD: CNNVD-200912-352

SOURCES

db:	VULHUB	id:	VHN-41865
db:	BID	id:	37430
db:	JVNDB	id:	JVNDB-2009-005232
db:	PACKETSTORM	id:	84169
db:	CNNVD	id:	CNNVD-200912-352
db:	NVD	id:	CVE-2009-4419

LAST UPDATE DATE

2025-04-10T23:04:59.923000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-41865	date:	2017-08-17T00:00:00
db:	BID	id:	37430	date:	2009-12-29T15:12:00
db:	JVNDB	id:	JVNDB-2009-005232	date:	2012-09-25T00:00:00
db:	CNNVD	id:	CNNVD-200912-352	date:	2009-12-25T00:00:00
db:	NVD	id:	CVE-2009-4419	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-41865	date:	2009-12-24T00:00:00
db:	BID	id:	37430	date:	2009-12-21T00:00:00
db:	JVNDB	id:	JVNDB-2009-005232	date:	2012-09-25T00:00:00
db:	PACKETSTORM	id:	84169	date:	2009-12-22T12:23:24
db:	CNNVD	id:	CNNVD-200912-352	date:	2009-12-24T00:00:00
db:	NVD	id:	CVE-2009-4419	date:	2009-12-24T17:30:00.250