The remote NewStart CGSL host, running version MAIN 4.06, has microcode_ctl packages installed that are affected by multiple vulnerabilities:

  - Insufficient access control in protected memory subsystem for Intel(R) SGX for 6th, 7th, 8th, 9th     Generation Intel(R) Core(TM) Processor Families; Intel(R) Xeon(R) Processor E3-1500 v5, v6 Families;
    Intel(R) Xeon(R) E-2100 & E-2200 Processor Families with Intel(R) Processor Graphics may allow a     privileged user to potentially enable information disclosure via local access. (CVE-2019-0117)

  - Cleanup errors in some Intel(R) Processors may allow an authenticated user to potentially enable     information disclosure via local access. (CVE-2020-0548)

  - Cleanup errors in some data cache evictions for some Intel(R) Processors may allow an authenticated user     to potentially enable information disclosure via local access. (CVE-2020-0549)

  - Improper removal of sensitive information before storage or transfer in some Intel(R) Processors may allow     an authenticated user to potentially enable information disclosure via local access. (CVE-2020-8696)

  - Improper isolation of shared resources in some Intel(R) Processors may allow an authenticated user to     potentially enable information disclosure via local access. (CVE-2020-8698)

  - Incomplete cleanup from specific special register read operations in some Intel(R) Processors may allow an     authenticated user to potentially enable information disclosure via local access. (CVE-2020-0543)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

NewStart CGSL MAIN 4.06 : microcode_ctl Multiple Vulnerabilities (NS-SA-2021-0001)

medium Nessus Plugin ID 147405

No changelogs found