Does SonicWall block against CVE-2017-5689?

03/26/2020 3 11819

DESCRIPTION:

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

SonicWall can block against this attack by two IPS signatures:

1. IPS Signature ID: 12769 "Intel Active Management Technology Access 1"

2. IPS Signature ID: 12770 "Intel Active Management Technology Access 2"

RESOLUTION:

To confirm that your SonicWall is blocking these signatures please perform the following:

1. Login to the SonicWall as an Administrator.
   
   
2. Select Security Services | Intrusion Prevention.
   
   
3. Use the Lookup Signature ID text box and search via the first signature 12769.
   
   
   
4. Confirm that the signatures are using either Global values (that are enabled to Prevent) or individually select the signature to prevent.

The following references were used while creating this solution:

• https://nvd.nist.gov/vuln/detail/CVE-2017-5689
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5689