High severity · published May 17, 2019
CVE-2019-0171
Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Improper directory permissions in the installer for Intel(R) Quartus(R) software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
QI
Quartus II · Intel
9.1 through 15.0 · source: NVD
QP
Quartus Prime · Intel
15.1 through 18.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-0171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-0171
Third Party Advisory
https://support.f5.com/csp/article/K33245306
Patch
https://www.intel.com/content/www/us/en/security-center/advisory/INTEL-SA-00244.html
More from Quartus II
7.8
CVE-2018-3684
Unquoted service paths in Intel Quartus II in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrary code