Intel SA-00075 Security Bulletin - Intel Active Management Technology (AMT), Intel Standard Manageability (ISM) and Intel Small Business Technology

On May 1st 2017, Intel published a security advisory regarding a firmware vulnerability in certain systems that utilize Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM) or Intel® Small Business Technology (SBT). The vulnerability could enable a network attacker to remotely gain access to business PCs or devices that use these technologies.

Summary

There is an escalation of privilege vulnerability in Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology versions firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 that can allow an unprivileged attacker to gain control of the manageability features provided by these products.  This vulnerability does not exist on Intel-based consumer PCs with consumer firmware, Intel servers utilizing Intel® Server Platform Services (Intel® SPS), or Intel® Xeon® Processor E3 and Intel® Xeon® Processor E5 workstations utilizing Intel® SPS firmware.

Description

There are two ways this vulnerability may be accessed, please note that Intel® Small Business Technology is only vulnerable to the second method:

• An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel® Active Management Technology (AMT) and Intel® Standard Manageability (ISM).
• An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology (SBT).

Threat level

Severe.

• A system with unpatched ME firmware, running the Intel Local Manageability Service, is affected, whether or not vPro is provisioned.
• A system with unpatched ME firmware, with vPro provisioned, is affected, whether or not the Local Manageability Service is running.

Recommendations

Our customer's security is paramount, to that end Stone are working with key vendors to provide firmware updates which close this vulnerability as quickly as possible. Those updates will be able available to download from this article as soon as they are made available to us

Intel has released a discovery tool which will analyse your systems for the vulnerability.

Actions:

1. Determine if you have an Intel® AMT, Intel® SBA, or Intel® ISM capable systems. If you determine that you do not have an Intel® AMT, Intel® SBA, or Intel® ISM capable system then no further action is required.

2. Utilize the INTEL-SA-00075 Detection Guide to assess if your system has the impacted firmware.

3. Stone highly recommends updating affected systems Management Engine (ME) firmware as soon as they become available. Please review the affected products section of this article for ME firmware update availability.

• Management Engine (ME) Firmware versions that resolve the issue have a four digit build number that starts with a “3” (X.X.XX.3XXX) Example: 8.1.71.3608.
• After the BIOS or ME patch update, to completely mitigate any risks, any previously configured AMT functionality should be de-provisioned and then re-configured. This prevents any compromised machines from retaining "hacked" logins.

4. If a firmware update is not yet available, mitigations are provided by the INTEL-SA-00075 Mitigation Guide. It is recommended that unpatched systems should have the steps detailed in the mitgation guide applied to them until such time as an ME firmware update becomes available.

• De-provision AMT
• Fully disable the Local Management / Manageability Service within the operating system

Affected Products

The issue has been observed in Intel manageability firmware versions 6.x, 7.x, 8.x 9.x, 10.x, 11.0, 11.5, and 11.6 for Intel® Active Management Technology, Intel® Small Business Technology, and Intel® Standard Manageability. Versions before 6 or after 11.6 are not impacted.

Where possible, updated BIOSes or patches for Management Engine Firmware are shown below. This article will be updated as more BIOSes or patches become available.

StonePC Lite/Tower / All In One

Legacy Desktop Products

Further information regarding Intel’s release schedule for their own branded desktop products can be found here.

StonePC Micro

Stone Notebooks

Applies to:

• Stone Desktop, Notebook and NUC products with Intel AMT (such as B or Q series chipsets),