Vulnerability Details : CVE-2016-1493
Intel Driver Update Utility before 2.4 retrieves driver updates in cleartext, which makes it easier for man-in-the-middle attackers to execute arbitrary code via a crafted file.
Vulnerability category: Execute code
Exploit prediction scoring system (EPSS) score for CVE-2016-1493
Probability of exploitation activity in the next 30 days: 0.42%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 71 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2016-1493
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.6
|
HIGH | AV:N/AC:H/Au:N/C:C/I:C/A:C |
4.9
|
10.0
|
NIST |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.6
|
5.9
|
NIST |
CWE ids for CVE-2016-1493
-
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-1493
-
http://www.coresecurity.com/advisories/intel-driver-update-utility-mitm
Intel Driver Update Utility MiTM | Core Security
-
https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00048&languageid=en-fr
INTEL-SA-00048Patch;Vendor Advisory
-
http://seclists.org/fulldisclosure/2016/Jan/56
Full Disclosure: [CORE-2016-0001] - Intel Driver Update Utility MiTM
-
http://packetstormsecurity.com/files/135314/Intel-Driver-Update-Utility-2.2.0.5-Man-In-The-Middle.html
Intel Driver Update Utility 2.2.0.5 Man-In-The-Middle ≈ Packet Storm
-
http://www.securityfocus.com/archive/1/537327/100/0/threaded
SecurityFocus
Products affected by CVE-2016-1493
- cpe:2.3:a:intel:driver_update_utility:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:intel:driver_update_utility:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:intel:driver_update_utility:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:intel:driver_update_utility:2.3:*:*:*:*:*:*:*