{"id":7258,"date":"2018-10-04T00:12:00","date_gmt":"2018-10-03T22:12:00","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=7258"},"modified":"2020-09-15T22:58:51","modified_gmt":"2020-09-15T20:58:51","slug":"warning-against-intel-extreme-tuning-utility-xtu-v6-4-1-23","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2018\/10\/04\/warning-against-intel-extreme-tuning-utility-xtu-v6-4-1-23\/","title":{"rendered":"Warning against Intel Extreme Tuning Utility (XTU) V6.4.1.23"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" style=\"float: left; margin: 0px 10px 0px 0px; display: inline\" src=\"https:\/\/www.borncity.com\/blog\/wp-content\/uploads\/2015\/01\/Schutz.jpg\" width=\"40\" align=\"left\" height=\"47\">[<a href=\"https:\/\/www.borncity.com\/blog\/2018\/10\/02\/warnung-vor-intel-extreme-tuning-utility-xtu-v6-4-1-23\/\" target=\"_blank\" rel=\"noopener noreferrer\">German<\/a>]Intel offers the free Intel Extreme Tuning Utility (XTU) for tuning its CPUs. However, the tool is as night mare in terms of security and you should keep your hands off it. Here's a quick look under the hood to see what's broken.<\/p>\n<p><!--more--><\/p>\n<h2>What is the Intel Extreme Tuning Utility (XTU)?<\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"\" src=\"https:\/\/vg04.met.vgwort.de\/na\/b4bd4c3365294cf9aee2489e42685ceb\" width=\"1\" height=\"1\">The Intel\u00ae Extreme Tuning Utility (Intel\u00ae XTU) is available <a href=\"https:\/\/web.archive.org\/web\/20200602042809\/https:\/\/downloadcenter.intel.com\/download\/24075\/Intel-Extreme-Tuning-Utility-Intel-XTU-\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a> for free download for Windows 7 and Windows 10 (64 Bit). The almost 30 MByte setup files set up an English version of the tool on the system. The manufacturer writes to the tool:<\/p>\n<blockquote>\n<p>Intel XTU is a simple Windows-based performance tuning software for beginners and experienced enthusiasts to overclock, monitor and stress a system. The software interface offers a number of robust features common to most enthusiast platforms, as well as special new features for new Intel\u00ae application processors and Intel\u00ae motherboards..<\/p>\n<\/blockquote>\n<p>On <a href=\"https:\/\/web.archive.org\/web\/20200602042809\/https:\/\/downloadcenter.intel.com\/download\/24075\/Intel-Extreme-Tuning-Utility-Intel-XTU-\" target=\"_blank\" rel=\"noopener noreferrer\">this Intel site<\/a> and <a href=\"https:\/\/www.intel.com\/content\/www\/us\/en\/support\/products\/66427\/processors\/processor-utilities-and-programs\/intel-extreme-tuning-utility-intel-xtu.html\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a> you will find some informationen about XTU. Another article at <a href=\"https:\/\/www.notebookcheck.net\/Intel-Extreme-Tuning-Utility-XTU-Undervolting-Guide.272120.0.html\" target=\"_blank\" rel=\"noopener noreferrer\">notebookcheck.net<\/a> covers this topic. The tool sounds intersting.  <\/p>\n<h2>Security risk Intel Extreme Tuning Utility (XTU)?<\/h2>\n<p>If you think you have to install and use this tool on your system, you should first read the following text. On seclists.org I came across <a href=\"https:\/\/seclists.org\/fulldisclosure\/2018\/Sep\/56\" target=\"_blank\" rel=\"noopener noreferrer\">this entry<\/a> from the end of September 2018. Stefan Kanthak took the tool XTU-Setup.exe, version 6.4.1.23 (released on May 18, 2018) and documented some unpleasant things. .&nbsp; <\/p>\n<h3>Vulnerability #1<\/h3>\n<p>The XTU-Setup.exe executable installation program contains at least two obsolete and unsupported Microsoft runtime components. One runtime component has known vulnerabilities that have been fixed for a long time.<\/p>\n<ul>\n<li>Component #1: 2010 Microsoft SQL Server Compact 3.5 SP2 ENU; this component reached its end-of-life on April 10, 2018 (not even found on the Microsoft pages).\n<li>Component #2: Microsoft Visual C++ 2005 Runtime 8.0.50727.762; the Visual C++ 2005 runtime environment has also reached the End of Life since April 12, 2016 (expired only two years ago).<\/li>\n<\/ul>\n<p>The tool will be delivered with two Microsoft products that have dropped out of support during installation. The last Visual C++ 2005 Runtime is version 8.0.50727.4940, which was released on April 12, 2011 and updated on June 14, 2011 (seven years ago).  <\/p>\n<p>And the installer XTU-Setup.exe tries, to install the unsecure Microsoft Visual C++ 2005 Runtime 8.0.50727.762 (out of support since long time), even if a newer version of the runtime environment is available.<\/p>\n<h2>Vulnerability #2<\/h2>\n<p>The package <em>vcredist_x86.exe<\/em> included in <em>XTU-Setup.exe<\/em> was created with the Wix Toolset 3.6. However, everything created with this toolset is insecure because the toolset has security holes (see <a href=\"http:\/\/seclists.org\/bugtraq\/2016\/Jan\/105\" target=\"_blank\" rel=\"noopener noreferrer\">here<\/a> and <a href=\"https:\/\/www.firegiant.com\/blog\/2016\/1\/20\/wix-v3.10.2-released\/\">here<\/a>).  <\/p>\n<h3>Code execution with privilege escalation vulnerability<\/h3>\n<p>The vulnerabilities mentioned above allow an attacker to execute arbitrary code under the context of the user account and to extend privileges through vulnerabilities. Kanthak describes a proof-of-concept on <a href=\"https:\/\/seclists.org\/fulldisclosure\/2018\/Sep\/56\" target=\"_blank\" rel=\"noopener noreferrer\">seclists.org<\/a>.<\/p>\n<p>In addition, the installer enables a Denial of Service attack (without requiring administrator privileges). The setup remains stuck at about 75% during installation.  <\/p>\n<h2>Communication with Intel and a Security Warning<\/h2>\n<p>Kanthak first reported the vulnerability to Intel on September 4, 2017 without receiving any response. On March 22, 2018, a new vulnerability report was sent to Intel. Intel then updated the installer on May 18, 2018 without further notice. Of course, this installer version also had security vulnerabilities. Therefore, a new report was sent to Intel on June 5, 2018 with vulnerability notifications.<\/p>\n<p>Now it's getting scary: On September 11, 2018, Intel releases its own <a href=\"https:\/\/www.intel.com\/content\/www\/us\/en\/security-center\/advisory\/intel-sa-00162.html\" target=\"_blank\" rel=\"noopener noreferrer\">Security Advisory<\/a>, warning about Escalation of Privilege and Denial of Service vulnerabilities. The vulnerabilities (CVE-2018-12150, CVE-2018-12149, CVE-2018-12151) are rated High with the security impact.<\/p>\n<p>According to the Intel document, this affects the Intel\u00ae Extreme Tuning Utility before version 6.4.1.21. Intel recommends updating to version 6.4.1.23 or higher. Kanthak has therefore published its own advisory on <a href=\"https:\/\/seclists.org\/fulldisclosure\/2018\/Sep\/56\" target=\"_blank\" rel=\"noopener noreferrer\">seclists.org<\/a>. Because of the issues mentioned above, this advisory warns against the Intel recommended version 6.4.1.23. At this point I can only give one advice: Keep your hands off these Intel tools, because these vulnerabilities have been running through these products for years.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>[German]Intel offers the free Intel Extreme Tuning Utility (XTU) for tuning its CPUs. However, the tool is as night mare in terms of security and you should keep your hands off it. Here's a quick look under the hood to &hellip; <a href=\"https:\/\/borncity.com\/win\/2018\/10\/04\/warning-against-intel-extreme-tuning-utility-xtu-v6-4-1-23\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1547],"tags":[599,69,1544],"class_list":["post-7258","post","type-post","status-publish","format-standard","hentry","category-security","category-software","tag-intel","tag-security","tag-software"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/7258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=7258"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/7258\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=7258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=7258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=7258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}