Details of VAR-201812-0617

ID

VAR-201812-0617

CVE

CVE-2018-3704

TITLE

Intel Parallel Studio Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2018-013102

DESCRIPTION

Improper directory permissions in the installer for the Intel Parallel Studio before 2019 Gold may allow authenticated users to potentially enable an escalation of privilege via local access. Intel Parallel Studio Contains vulnerabilities related to authorization, permissions, and access control.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Intel Parallel Studio is a development kit for high-performance applications developed by Intel Corporation. A security vulnerability exists in the installer in versions prior to Intel Parallel Studio 2019 Gold. A local attacker could exploit this vulnerability to elevate privileges

Trust: 1.71

sources: NVD: CVE-2018-3704 // JVNDB: JVNDB-2018-013102 // VULHUB: VHN-133735

AFFECTED PRODUCTS

vendor:	intel	model:	parallel studio xe	scope:	eq	version:	-	Trust: 1.6
vendor:	intel	model:	parallel studio	scope:	lt	version:	2019	Trust: 1.0
vendor:	intel	model:	parallel studio	scope:	-	version:	-	Trust: 0.8
vendor:	intel	model:	parallel studio xe	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2018-013102 // CNNVD: CNNVD-201812-666 // NVD: CVE-2018-3704

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-3704
value:	HIGH
Trust: 1.0
NVD:	CVE-2018-3704
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201812-666
value:	HIGH
Trust: 0.6
VULHUB:	VHN-133735
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-3704
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-133735
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-3704
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-133735 // JVNDB: JVNDB-2018-013102 // CNNVD: CNNVD-201812-666 // NVD: CVE-2018-3704

PROBLEMTYPE DATA

problemtype:	CWE-732	Trust: 1.1
problemtype:	CWE-264	Trust: 0.8

sources: VULHUB: VHN-133735 // JVNDB: JVNDB-2018-013102 // NVD: CVE-2018-3704

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201812-666

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201812-666

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-013102

PATCH

title:	INTEL-SA-00208	url:	https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00208.html	Trust: 0.8
title:	Intel Parallel Studio Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87902	Trust: 0.6

sources: JVNDB: JVNDB-2018-013102 // CNNVD: CNNVD-201812-666

EXTERNAL IDS

db:	NVD	id:	CVE-2018-3704	Trust: 2.5
db:	JVNDB	id:	JVNDB-2018-013102	Trust: 0.8
db:	CNNVD	id:	CNNVD-201812-666	Trust: 0.7
db:	VULHUB	id:	VHN-133735	Trust: 0.1

sources: VULHUB: VHN-133735 // JVNDB: JVNDB-2018-013102 // CNNVD: CNNVD-201812-666 // NVD: CVE-2018-3704

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00208.html	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-3704	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-3704	Trust: 0.8

sources: VULHUB: VHN-133735 // JVNDB: JVNDB-2018-013102 // CNNVD: CNNVD-201812-666 // NVD: CVE-2018-3704

SOURCES

db:	VULHUB	id:	VHN-133735
db:	JVNDB	id:	JVNDB-2018-013102
db:	CNNVD	id:	CNNVD-201812-666
db:	NVD	id:	CVE-2018-3704

LAST UPDATE DATE

2024-11-23T22:17:14.596000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-133735	date:	2019-10-03T00:00:00
db:	JVNDB	id:	JVNDB-2018-013102	date:	2019-02-14T00:00:00
db:	CNNVD	id:	CNNVD-201812-666	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2018-3704	date:	2024-11-21T04:05:55.260

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-133735	date:	2018-12-14T00:00:00
db:	JVNDB	id:	JVNDB-2018-013102	date:	2019-02-14T00:00:00
db:	CNNVD	id:	CNNVD-201812-666	date:	2018-12-14T00:00:00
db:	NVD	id:	CVE-2018-3704	date:	2018-12-14T00:29:01.453