Sign-up

ID

VAR-202106-0878


CVE

CVE-2021-0074


TITLE

Intel(R) Computing Improvement Program  Software vulnerabilities related to improper retention of permissions

Trust: 0.8

sources: JVNDB: JVNDB-2021-008439

DESCRIPTION

Improper permissions in the installer for the Intel(R) Computing Improvement Program software before version 2.4.5982 may allow an authenticated user to potentially enable escalation of privilege via local access. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Intel Computing Improvement Program is a software improvement program application program of Intel Corporation. This program is used to collect computer function usage information, component usage information, operating system information, etc. The following products and models are affected: Intel Computing Improvement Program versions prior to 2.4.5982

Trust: 2.25

sources: NVD: CVE-2021-0074 // JVNDB: JVNDB-2021-008439 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-371643

AFFECTED PRODUCTS

vendor:intelmodel:computing improvement programscope:ltversion:2.4.5982

Trust: 1.0

vendor:インテルmodel:intel computing improvement programscope:eqversion:2.4.5982

Trust: 0.8

vendor:インテルmodel:intel computing improvement programscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-008439 // NVD: CVE-2021-0074

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-0074
value: HIGH

Trust: 1.0

NVD: CVE-2021-0074
value: HIGH

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202106-717
value: HIGH

Trust: 0.6

VULHUB: VHN-371643
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2021-0074
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-371643
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2021-0074
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2021-0074
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-371643 // JVNDB: JVNDB-2021-008439 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-717 // NVD: CVE-2021-0074

PROBLEMTYPE DATA

problemtype:CWE-281

Trust: 1.1

problemtype:Improper retention of permissions (CWE-281) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-371643 // JVNDB: JVNDB-2021-008439 // NVD: CVE-2021-0074

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202106-717

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:INTEL-SA-00530url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00530.html

Trust: 0.8

title:Intel Computing Improvement Program Fixes for permissions and access control issues vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=155263

Trust: 0.6

sources: JVNDB: JVNDB-2021-008439 // CNNVD: CNNVD-202106-717

EXTERNAL IDS

db:NVDid:CVE-2021-0074

Trust: 3.3

db:JVNid:JVNVU99965981

Trust: 0.8

db:JVNDBid:JVNDB-2021-008439

Trust: 0.8

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021061606

Trust: 0.6

db:AUSCERTid:ESB-2021.2001

Trust: 0.6

db:CNNVDid:CNNVD-202106-717

Trust: 0.6

db:VULHUBid:VHN-371643

Trust: 0.1

sources: VULHUB: VHN-371643 // JVNDB: JVNDB-2021-008439 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-717 // NVD: CVE-2021-0074

REFERENCES

url:https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00530.html

Trust: 1.7

url:https://nvd.nist.gov/vuln/detail/cve-2021-0074

Trust: 1.4

url:https://jvn.jp/vu/jvnvu99965981/

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2021.2001

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021061606

Trust: 0.6

sources: VULHUB: VHN-371643 // JVNDB: JVNDB-2021-008439 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202106-717 // NVD: CVE-2021-0074

SOURCES

db:VULHUBid:VHN-371643
db:JVNDBid:JVNDB-2021-008439
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202106-717
db:NVDid:CVE-2021-0074

LAST UPDATE DATE

2024-08-14T12:12:25.526000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-371643date:2021-06-24T00:00:00
db:JVNDBid:JVNDB-2021-008439date:2022-03-16T07:27:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202106-717date:2021-06-28T00:00:00
db:NVDid:CVE-2021-0074date:2021-06-24T11:43:37.267

SOURCES RELEASE DATE

db:VULHUBid:VHN-371643date:2021-06-09T00:00:00
db:JVNDBid:JVNDB-2021-008439date:2022-03-16T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202106-717date:2021-06-09T00:00:00
db:NVDid:CVE-2021-0074date:2021-06-09T20:15:08.460