{"id":91382,"date":"2020-08-12T13:42:03","date_gmt":"2020-08-12T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3"},"modified":"2020-08-12T13:42:03","modified_gmt":"2020-08-12T11:42:03","slug":"udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","title":{"rendered":"Vulnerabilidad remota en las placas base de servidor Intel con BMC Emulex Pilot 3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

La empresa Intel inform\u00f3<\/a><\/noindex> sobre la correcci\u00f3n de 22 vulnerabilidades en el firmware de sus placas base de servidor, sistemas de servidores y m\u00f3dulos de computaci\u00f3n. Tres vulnerabilidades, una de las cuales se clasifica como cr\u00edtica, (CVE-2020-8708<\/a><\/noindex> \u2014 CVSS 9.6, CVE-2020-8707<\/a><\/noindex> \u2014 CVSS 8.3, CVE-2020-8706<\/a><\/noindex> \u2014 CVSS 4.7) se manifiesta<\/a><\/noindex> en el firmware del controlador BMC Emulex Pilot 3, utilizado en productos Intel. Las vulnerabilidades permiten el acceso a la consola de gesti\u00f3n remota (KVM) sin autenticaci\u00f3n, eludir la autenticaci\u00f3n al emular dispositivos de almacenamiento USB y provocar un desbordamiento de b\u00fafer remoto en el n\u00facleo de Linux utilizado en BMC. <\/p>\n

La vulnerabilidad CVE-2020-8708 permite a un atacante no autenticado, que tenga acceso a un segmento de red local compartido con el servidor vulnerable, acceder al entorno de gesti\u00f3n BMC. Se observa que la t\u00e9cnica de explotaci\u00f3n de la vulnerabilidad es muy sencilla y confiable, ya que el problema se debe a un error arquitect\u00f3nico. Adem\u00e1s, por palabras<\/a><\/noindex> el investigador que identific\u00f3 la vulnerabilidad, trabajar con BMC a trav\u00e9s de un exploit es mucho m\u00e1s conveniente que mediante el cliente Java est\u00e1ndar. Entre el hardware afectado se mencionan las familias de sistemas de servidores Intel R1000WT, R2000WT, R1000SP, LSVRP, LR1304SP, R1000WF y R2000WF, placas madre S2600WT, S2600CW, S2600KP, S2600TP, S1200SP, S2600WF, S2600ST y S2600BP, as\u00ed como m\u00f3dulos de computaci\u00f3n HNS2600KP, HNS2600TP y HNS2600BP. Las vulnerabilidades fueron corregidas en la actualizaci\u00f3n de firmware 1.59.<\/p>\n

Seg\u00fan informes no oficiales, los datos<\/a><\/noindex> el firmware para BMC Emulex Pilot 3 fue escrito por la empresa AMI, por lo que no se descarta<\/a><\/noindex> la manifestaci\u00f3n de vulnerabilidades en sistemas de otros fabricantes. Los problemas est\u00e1n presentes en parches externos al n\u00facleo de Linux y en el proceso de gesti\u00f3n que se ejecuta en el espacio de usuario, cuyo c\u00f3digo el investigador que identific\u00f3 el problema lo caracteriz\u00f3 como el peor c\u00f3digo con el que se ha encontrado.<\/p>\n

Recordemos que BMC es un controlador especializado que se instala en los servidores, el cual cuenta con su propio CPU, memoria, almacenamiento e interfaces para la consulta de sensores. Proporciona una interfaz de bajo nivel para el monitoreo y la gesti\u00f3n del hardware del servidor. A trav\u00e9s de BMC, se puede monitorear el estado de los sensores, gestionar la alimentaci\u00f3n, los firmwares y los discos, organizar el arranque remoto por la red, garantizar el funcionamiento de la consola de acceso remoto, etc., independientemente del sistema operativo que est\u00e9 en ejecuci\u00f3n en el servidor. <\/p>\n

<\/a><\/noindex><\/p>\n

Fuente: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 22 \u0443\u044f\u0432\u0437\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442, \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439. \u0422\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c, (CVE-2020-8708 — CVSS 9.6, CVE-2020-8707 — CVSS 8.3, CVE-2020-8706 — CVSS 4.7) \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 Emulex Pilot 3, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Intel. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91382","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidad remota en placas de servidor Intel con BMC Emulex Pilot 3 | ProHoster","description":"La empresa Intel anunci\u00f3 la correcci\u00f3n de 22 vulnerabilidades en los firmwares de sus servidores.","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 Intel \u0441 BMC Emulex Pilot 3 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 22 \u0443\u044f\u0432\u0437\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T11:42:03+00:00","article:modified_time":"2020-08-12T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91382","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:28:28","updated":"2022-10-02 06:48:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/91382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=91382"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/91382\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=91382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=91382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=91382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}