{"id":36271,"date":"2019-10-31T22:10:36","date_gmt":"2019-10-31T19:10:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\/"},"modified":"2019-10-31T22:10:36","modified_gmt":"2019-10-31T19:10:36","slug":"uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","title":{"rendered":"BMC-kontrollerite p\u00fcsivara haavatavus, mis m\u00f5jutab paljude tootjate servereid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te Eclypsium tuvas<\/a><\/noindex> kaks haavatavust BMC-kontrolleri p\u00fcsivara versioonides, mida tarnitakse Lenovo ThinkServeri serveritesse, v\u00f5imaldades kohalikul kasutajal p\u00fcsivara asendada v\u00f5i k\u00e4ivitada BMC-kiibi poolel suvalist koodi.<\/p>\n

Edasiuurimine n\u00e4itas, et need probleemid m\u00f5jutavad ka BMC-kontrollerite p\u00fcsivara versioone, mida kasutatakse Gigabyte Enterprise Serverite platvormidel, mida kasutavad ka sellised ettev\u00f5tted nagu Acer, AMAX, Bigtera, Ciara, Penguin Computing ja sysGen. Probleemsetes BMC-kontrollerites kasutati haavatavat MergePoint EMS p\u00fcsivara, mille on v\u00e4lja t\u00f6\u00f6tanud kolmas osapool Avocent (praegu Vertivi t\u00fctarettev\u00f5te). <\/p>\n

Esimene haavatavus on p\u00f5hjustatud kr\u00fcptograafilise autentimise puudumisest laaditavate p\u00fcsivara uuenduste jaoks (kasutatakse ainult CRC32 kontrollsummade kontrollimist, mis on vastuolus soovitustega<\/a><\/noindex> NIST kasutab digitaalseid allkirju, mis v\u00f5imaldab r\u00fcndajal, kellel on kohalik juurdep\u00e4\u00e4s s\u00fcsteemile, BMC p\u00fcsivara asendada. Probleem v\u00f5ib n\u00e4iteks v\u00f5imaldada s\u00fcgava rootkit'i integreerimist, mis j\u00e4\u00e4b aktiivseks p\u00e4rast operatsioonis\u00fcsteemi uuesti installimist ja takistab edasisi p\u00fcsivara uuendusi (rootkit'i k\u00f5rvaldamiseks on vajalik SPI flash'i \u00fcmberprogrammeerimise seadme kasutamine).<\/p>\n

Teine haavatavus on seotud p\u00fcsivara v\u00e4rskenduskoodiga, mis v\u00f5imaldab lisada oma k\u00e4ske, mis t\u00e4idetakse BMC k\u00f5rgeimatega privileegidega. R\u00fcnnakuks piisab v\u00e4\u00e4rtuse muutmisest konfigureerimifailis bmcfwu.cfg olevas parameetris RemoteFirmwareImageFilePath, mille kaudu m\u00e4\u00e4ratakse v\u00e4rskendatava p\u00fcsivara pilt. J\u00e4rgmise v\u00e4rskenduse ajal, mille saab k\u00e4ivitada IPMI k\u00e4suga, t\u00f6\u00f6deldakse see parameeter BMC poolt ja seda kasutatakse popen() kutsumise osana stringina \/bin\/sh. Kuna shell-k\u00e4skluse vormimise stringi genereeritakse snprintf() kutsumisega ilma vajaliku erim\u00e4rkide puhastamiseta, saavad r\u00fcndajad sisestada oma koodi t\u00e4itmiseks. Haavatavuse \u00e4rakasutamiseks on vajalik \u00f5iguste olemasolu, mis v\u00f5imaldab IPMI kaudu BMC kontrollerile k\u00e4sku saata (serveris admin\u00f5igustega saab IPMI k\u00e4sku saata ilma t\u00e4iendava autentimiseta).<\/p>\n

Firmad Gigabyte ja Lenovo teavitati probleemidest juba 2018. aasta juulis ning suutsid enne avalike andmete avalikustamist v\u00e4lja anda v\u00e4rskendusi. Ettev\u00f5te Lenovo v\u00e4lja andnud<\/a><\/noindex> 15. novembril 2018. aastal v\u00e4ljastatud ThinkServer RD340, TD340, RD440, RD540 ja RD640 serverite firmware'i v\u00e4rskendused parandasid vaid haavatavuse, mis v\u00f5imaldas k\u00e4ske asendada, kuna FusionPoint EMS-i serverite seeria loomise ajal 2014. aastal ei olnud digitaalallkirjade kontrollimine laialdaselt levinud ega algselt v\u00e4lja kuulutatud.<\/p>\n

Sel aasta 8. mail vabastas ettev\u00f5te Gigabyte v\u00e4rskendused ASPEED AST2500 kontrolleriga emaplaatidele, kuid nagu ka Lenovo, parandas see ainult k\u00e4ske asendava haavatavuse. Haavatavad ASPEED AST2400 plaadid j\u00e4\u00e4vad endiselt v\u00e4rskenduseta. Gigabyte samuti r\u00e4\u00e4kis<\/a><\/noindex> on teatanud \u00fcleminekust AMI MegaRAC SP-X firmware'ile. Uued MegaRAC SP-X-p\u00f5hised firmware'id pakutakse s\u00fcsteemidele, mis eelnevalt toodi turule MergePoint EMS firmware'iga. Otsus tehti p\u00e4rast Vertiv'i avaldust MergePoint EMS platvormi toe l\u00f5petamise kohta. Samuti ei ole veel teavet v\u00e4rskenduste kohta serverite puhul, mida toodavad ettev\u00f5tted Acer, AMAX, Bigtera, Ciara, Penguin Computing ja sysGen Gigabyte'i plaatide baasil, millel on haavatavad MergePoint EMS-i firmware'id.<\/p>\n

Meeldetuletuseks: BMC on spetsialiseeritud kontroller, mis paigaldatakse serveritesse, millel on oma CPU, m\u00e4lu, salvestus ja anduritelt k\u00fcsitluse liidesed. See pakub madala taseme liidest serveri riistvara j\u00e4lgimiseks ja juhtimiseks. BMC abil, s\u00f5ltumata serveris t\u00f6\u00f6tavast operatsioonis\u00fcsteemist, saab j\u00e4lgida andurite seisundit, hallata toite, p\u00fcsivara ja kettaid, korraldada kauglaadimist v\u00f5rgu kaudu, tagada kaugjuhtimiskonsooli t\u00f6\u00f6 jne.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Lenovo ThinkServer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 BMC. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Gigabyte Enterprise Servers, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0430\u043a Acer, AMAX, Bigtera, Ciara, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36271","post","type-post","status-publish","format-standard","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BMC-kontrollerite p\u00fcsivara haavatavus, mis m\u00f5jutab paljude tootjate servereid | ProHoster","description":"Eclypsium avastas kaks haavatavust Lenovo ThinkServeri serverites tarnitava BMC-kontrolleri p\u00fcsivara, mis v\u00f5imaldab kohalikul kasutajal p\u00fcsivara asendada v\u00f5i BMC-chipil suvalist koodi k\u00e4ivitada. Edasine anal\u00fc\u00fcs n\u00e4itas, et need probleemid puudutavad ka Gigabyte Enterprise Serverite serveriplatvormidel kasutatavaid BMC-kontrolleri p\u00fcsivara, mida kasutatakse ka selliste ettev\u00f5tete serverites nagu Acer, AMAX, Bigtera, Ciara.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Lenovo ThinkServer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 BMC. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Gigabyte Enterprise Servers, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0430\u043a Acer, AMAX, Bigtera, Ciara,","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:10:36+00:00","article:modified_time":"2019-10-31T19:10:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36271","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:18","updated":"2026-01-22 02:38:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36271"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36271\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}