{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Intel Data Center manager versions ant\u00e9rieures \u00e0 5.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Centrino Wireless-N 135",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur de la famille Intel Core de 6\u00e8me g\u00e9n\u00e9ration avec un microgiciel (CSME) ant\u00e9rieure \u00e0 11.8.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC7i3DNHE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Compute Card CD1P64GK",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Core X-Series avec un microgiciel (CSME) ant\u00e9rieure \u00e0 11.11.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel IoT Developers Kit versions 4.0 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC8i7HNK",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Board S2600BP (Purley)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Computing Improvement Program versions ant\u00e9rieures \u00e0 2.2.0.03942",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC7i7BNH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC5PGYH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Compute Stick STCK1A32WFC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Centrino Wireless-N 1030",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Xeon Scalable avec un microgiciel (CSME) ant\u00e9rieure \u00e0 11.21.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Compute Card CD1M3128MK",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel ME versions ant\u00e9rieures \u00e0 10.0.60",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC7i7DNKE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel ME versions ant\u00e9rieures \u00e0 9.1.45",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel CSME versions ant\u00e9rieures \u00e0 11.11.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Platform Service microgiciel ant\u00e9rieures \u00e0 SPS_SoC-X_04.00.04.077.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Centrino Wireless-N 130",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Board S2600WF",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Xeon W avec un microgiciel (CSME) ant\u00e9rieure \u00e0 11.11.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel QuickAssist Adapter 8960/8970 Products avec un microgiciel ant\u00e9rieure \u00e0 4.x.05",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Compute Stick STK1AW32SC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Board S2600TP (Grantley)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Xeon E3-1200/1500 v5 avec un microgiciel (CSME) ant\u00e9rieure \u00e0 11.8.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Platform Service microgiciel ant\u00e9rieures \u00e0 SPS_E5_04.00.04.381.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC5CPYH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit D54250WYB",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Trusted Execution Engine (TXE) versions ant\u00e9rieures \u00e0 4.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Distribution pour Python 2018 t\u00e9l\u00e9charg\u00e9 avant le 6 ao\u00fbt 2018",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel CSME versions ant\u00e9rieures \u00e0 12.0.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC6i5SYH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel C620 Series Chipset Family (PCIe End Point Mode) avec un microgiciel ant\u00e9rieure \u00e0 4.00.04.381.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC6CAYS",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC7CJYH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Centrino Advanced-N 6230",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC7i5DNKE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC5i5MYHE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC5i7RYH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur de la famille Intel Core de 8\u00e8me g\u00e9n\u00e9ration avec un microgiciel (CSME) ant\u00e9rieure \u00e0 12.0.6",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Centrino Wireless-N 2230",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC5i3MYHE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Xeon E3-1200/1500 v6 avec un microgiciel (CSME) ant\u00e9rieure \u00e0 11.8.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Platform Service microgiciel ant\u00e9rieures \u00e0 SPS_SoC-A_04.00.04.177.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit NUC6i7KYK",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit D33217GKE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Xeon D-2100 Family Platform avec un microgiciel ant\u00e9rieure \u00e0 4.00.04.077.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel ME versions ant\u00e9rieures \u00e0 9.5.65",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit DE3815TYBE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel CSME versions ant\u00e9rieures \u00e0 11.8.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Board S2600WT (Grantley)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Server Board S2600ST",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Data Migration Software versions 3.1 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Compute Stick STK2mv64CC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Xeon Scalable Family Platforms avec un microgiciel ant\u00e9rieure \u00e0 4.00.04.381.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit D53427RKE",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Compute Card CD1IV128MK",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Trusted Execution Engine (TXE) versions ant\u00e9rieures \u00e0 3.1.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Outil de d\u00e9tection pour la vuln\u00e9rabilit\u00e9 Intel-SA-00086 en version ant\u00e9rieure \u00e0 1.2.7.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Centrino Advanced-N 6235",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Extreme Tuning Utility versions ant\u00e9rieures \u00e0 6.4.1.23.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur de la famille Intel Core de 7\u00e8me g\u00e9n\u00e9ration avec un microgiciel (CSME) ant\u00e9rieure \u00e0 11.8.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel CSME versions ant\u00e9rieures \u00e0 11.21.55",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Processeur Intel Atom C3000 Series Platform avec un microgiciel ant\u00e9rieure \u00e0 4.00.04.177.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel NUC Kit DN2820FYKH",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel OpenVINO Toolkit pour Windows versions 2018.1.265 et ant\u00e9rieures",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Compute Stick STK2m3W64CC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    },
    {
      "description": "Intel Driver \u0026 Support Assistant versions ant\u00e9rieures \u00e0 3.5.0.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Intel",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-12162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12162"
    },
    {
      "name": "CVE-2018-3655",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3655"
    },
    {
      "name": "CVE-2018-12160",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12160"
    },
    {
      "name": "CVE-2018-3657",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3657"
    },
    {
      "name": "CVE-2018-3669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3669"
    },
    {
      "name": "CVE-2018-12151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12151"
    },
    {
      "name": "CVE-2018-12148",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12148"
    },
    {
      "name": "CVE-2018-12149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12149"
    },
    {
      "name": "CVE-2018-12176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12176"
    },
    {
      "name": "CVE-2018-3659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3659"
    },
    {
      "name": "CVE-2018-12171",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12171"
    },
    {
      "name": "CVE-2018-3658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3658"
    },
    {
      "name": "CVE-2018-3643",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3643"
    },
    {
      "name": "CVE-2018-12175",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12175"
    },
    {
      "name": "CVE-2018-3616",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3616"
    },
    {
      "name": "CVE-2017-15361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-15361"
    },
    {
      "name": "CVE-2018-12150",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12150"
    },
    {
      "name": "CVE-2018-12163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-12163"
    },
    {
      "name": "CVE-2018-3686",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3686"
    },
    {
      "name": "CVE-2018-3679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3679"
    }
  ],
  "initial_release_date": "2018-09-12T00:00:00",
  "last_revision_date": "2018-09-12T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-432",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-09-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Intel.\nCertaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une\nex\u00e9cution de code arbitraire, un d\u00e9ni de service et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Intel",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00119 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00119.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00125 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00125.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00162 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00162.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00181 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00181.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00149 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00149.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00148 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00148.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00141 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00141.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00173 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00173.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00177 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00177.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00165 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00165.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00170 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00170.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00172 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00172.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00142 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00142.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00176 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00176.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00143 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00143.html"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Intel INTEL-SA-00131 du 11 septembre 2018",
      "url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00131.html"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Se r\u00e9f\u00e9rer aux avis du constructeur pour les syst\u00e8mes affect\u00e9s (cf. section Documentation)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Siemens",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2017-5705",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5705"
    },
    {
      "name": "CVE-2017-5708",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5708"
    },
    {
      "name": "CVE-2017-5710",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5710"
    },
    {
      "name": "CVE-2017-5754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5754"
    },
    {
      "name": "CVE-2017-5706",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5706"
    },
    {
      "name": "CVE-2017-5753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5753"
    },
    {
      "name": "CVE-2017-5712",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5712"
    },
    {
      "name": "CVE-2017-5707",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5707"
    },
    {
      "name": "CVE-2017-5715",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5715"
    },
    {
      "name": "CVE-2017-15361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-15361"
    },
    {
      "name": "CVE-2017-5709",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5709"
    },
    {
      "name": "CVE-2017-5711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-5711"
    }
  ],
  "initial_release_date": "2018-02-22T00:00:00",
  "last_revision_date": "2018-02-22T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-095",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-02-22T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans SCADA les produits\nSiemens . Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, une ex\u00e9cution de code\narbitraire et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans SCADA les produits Siemens",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SCADA Siemens ssa-470231 du 22 f\u00e9vrier 2018",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-470231.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SCADA Siemens ssa-168644 du 22 f\u00e9vrier 2018",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-168644.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 SCADA Siemens ssa-892715 du 22 f\u00e9vrier 2018",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-892715.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Biblioth\u00e8que RSA Infineon version v1.02.013",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "N/A",
          "scada": false
        }
      }
    },
    {
      "description": "Infineon TPM \"Trusted Platform Module\"",
      "product": {
        "name": "Platform",
        "vendor": {
          "name": "SolarWinds",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2017-11-27",
  "content": "## Solution\n\nLe CERT-FR recommande l\u0027application des correctifs de s\u00e9curit\u00e9 pour les\nTPM vuln\u00e9rables ainsi que la g\u00e9n\u00e9ration de nouvelles cl\u00e9s\ncryptographiques et la r\u00e9vocation des cl\u00e9s pr\u00e9c\u00e9demment g\u00e9n\u00e9r\u00e9es.\n\nLes correctifs des micrologiciels des TPM doivent \u00eatre r\u00e9cup\u00e9r\u00e9s aupr\u00e8s\ndu constructeur du syst\u00e8me consid\u00e9r\u00e9. Un lien vers une liste\nnon-exhaustive de logiciels et mat\u00e9riels impact\u00e9s est disponible \u00e0 la\nsection Documentation.\n\nL\u0027ensemble des donn\u00e9es chiffr\u00e9es avec des cl\u00e9s faibles doivent \u00eatre\nd\u00e9chiffr\u00e9es puis rechiffr\u00e9es avec de nouvelles cl\u00e9s. Le surchiffrement\ndes donn\u00e9es peut \u00eatre envisag\u00e9 mais alourdira la manipulation de donn\u00e9es\nchiffr\u00e9es.\n\nLes donn\u00e9es sign\u00e9es avec des cl\u00e9s faibles doivent \u00eatre sign\u00e9es avec de\nnouvelles cl\u00e9s.\n\nChaque infrastructure de gestion de cl\u00e9 doit faire l\u0027objet d\u0027une\nattention sp\u00e9cifique, pour identifier si les certificats \u00e9mis sont\nvuln\u00e9rables. Dans les environnements Microsoft, l\u0027usage de cl\u00e9s faibles\ndans un domaine *Active Directory* ou par *Bitlocker* conduit \u00e0 une\nniveau de s\u00e9curit\u00e9 particuli\u00e8rement bas.\n\n## Contournement provisoire\n\n\u00a0\n\nLes chercheurs ont publi\u00e9 sur le site internet github.com un outil\npermettant de tester si une cl\u00e9 RSA est vuln\u00e9rable (voir section\ndocumentation). L\u0027outil supporte plusieurs formats d\u0027entr\u00e9e (X509 DER ou\nPEM, cl\u00e9s SSH, cl\u00e9s PGP...). Le test peut s\u0027effectuer \u00e0 partir d\u0027une cl\u00e9\npriv\u00e9e ou d\u0027une cl\u00e9 publique.\n\nLe CERT-FR recommande de g\u00e9n\u00e9rer de nouvelles paires de cl\u00e9s RSA, de\ntaille minimum 3072 bits, en utilisant des biblioth\u00e8ques non vuln\u00e9rables\net de r\u00e9voquer les cl\u00e9s qui auraient pu \u00eatre g\u00e9n\u00e9r\u00e9es par cette\nbiblioth\u00e8que. Cette taille de cl\u00e9 est recommand\u00e9e dans l\u0027annexe B1 du\nRGS.\n\nPlusieurs \u00e9diteurs de logiciels utilisant des TPM ont mis en place une\nsolution de contournement, disponible par mise \u00e0 jour de ces logiciels.\nDe mani\u00e8re g\u00e9n\u00e9rale, ces solutions permettent la g\u00e9n\u00e9ration de cl\u00e9s de\nmani\u00e8re logicielle \u00e0 la place de l\u0027utilisation du TPM. Ces solutions ne\npermettent pas de corriger la faiblesse de cl\u00e9s d\u00e9j\u00e0 g\u00e9n\u00e9r\u00e9es. Seule la\nmise \u00e0 jour du micrologiciel du TPM permettra le retour \u00e0 une situation\nnormale. Dans le cas particulier de Windows, un des correctifs de\ns\u00e9curit\u00e9 d\u0027octobre ajoute une journalisation lors de l\u0027usage d\u0027un TPM\nvuln\u00e9rable. Cette possibilit\u00e9 facilite l\u0027identification des mat\u00e9riels\nvuln\u00e9rables.\n",
  "cves": [
    {
      "name": "CVE-2017-15361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-15361"
    }
  ],
  "initial_release_date": "2017-10-16T00:00:00",
  "last_revision_date": "2017-10-17T00:00:00",
  "links": [
    {
      "title": "Article de presse d\u0027Ars Technica du 16 octobre 2017",
      "url": "https://arstechnica.com/information-technology/2017/10/crypto-failure-cripples-millions-of-high-security-keys-750k-estonian-ids/"
    },
    {
      "title": "Liste des mat\u00e9riels et logiciels vuln\u00e9rables",
      "url": "http://www.kb.cert.org/vuls/id/307015"
    },
    {
      "title": "Annexe B1 du RGS",
      "url": "https://www.ssi.gouv.fr/uploads/2015/01/RGS_v-2-0_B1.pdf"
    },
    {
      "title": "Cas d\u0027usage dans les environnements Windows, contournements provisoires et d\u00e9finitifs",
      "url": "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV170012"
    },
    {
      "title": "Outil permettant la d\u00e9tection de cl\u00e9s vuln\u00e9rables",
      "url": "https://github.com/crocs-muni/roca"
    }
  ],
  "reference": "CERTFR-2017-ALE-015",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2017-10-16T00:00:00.000000"
    },
    {
      "description": "Compl\u00e9ment d\u0027information sur les correctifs",
      "revision_date": "2017-10-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Le 16 octobre 2017, des chercheurs de l\u0027universit\u00e9 Masaryk (R\u00e9publique\nTch\u00e8que), ont publi\u00e9 un article sur la d\u00e9couverte d\u0027une vuln\u00e9rabilit\u00e9\ndans la biblioth\u00e8que RSA d\u00e9velopp\u00e9e par Infineon.\n\nLeurs travaux seront pr\u00e9sent\u00e9s le 2 novembre 2017 \u00e0 la conf\u00e9rence \"ACM\nConference on Computer and Communcations Security\". D\u0027apr\u00e8s les\nchercheurs, un probl\u00e8me dans la g\u00e9n\u00e9ration du couple cl\u00e9 priv\u00e9e/publique\npermet de retrouver la cl\u00e9 priv\u00e9e \u00e0 partir de la cl\u00e9 publique\nuniquement. Cette attaque est applicable en pratique et peu co\u00fbteuse\n(76\\$ pour une cl\u00e9 de 1024 bits et 40300\\$ pour une cl\u00e9 de 2048 bits).\nLes syst\u00e8mes affect\u00e9s sont nombreux et comptent notamment des TPMs, des\ncl\u00e9s de chiffrement Bitlocker, des certificats TLS, des cl\u00e9s PGP ou SSH\nou encore des cartes \u00e0 puce.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans la biblioth\u00e8que Infineon RSA",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Article du centre pour la recherche en cryptographie et s\u00e9curit\u00e9 (CRoCS)",
      "url": "https://crocs.fi.muni.cz/public/papers/rsa_ccs17"
    }
  ]
}