{"id":36271,"date":"2019-10-31T22:10:36","date_gmt":"2019-10-31T19:10:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\/"},"modified":"2019-10-31T22:10:36","modified_gmt":"2019-10-31T19:10:36","slug":"uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","title":{"rendered":"Turbepunkt BMC kontrolleri p\u00fcsivara haavatavust, mis m\u00f5jutab paljusid tootjate servereid","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ettev\u00f5te Eclypsium tuvastas<\/a><\/noindex> Kaks haavatavust Lenovo ThinkServerite BMC-kontrollerite p\u00fcsivara, mis v\u00f5imaldab kohalikel kasutajatel p\u00fcsivara asendada v\u00f5i BMC-kiibi k\u00fcljes t\u00e4itmiseks juhuslikku koodi k\u00e4ivitada.<\/p>\n

Edasi uurimine n\u00e4itas, et need probleemi m\u00f5jutavad ka Gigabyte Enterprise Serverite BMC-kontrollerite p\u00fcsivara, mida kasutavad ka sellised ettev\u00f5tted nagu Acer, AMAX, Bigtera, Ciara, Penguin Computing ja sysGen. Probleemsetes BMC-kontrollerites kasutati haavatavaid MergePoint EMS p\u00fcsivara, mille on v\u00e4lja t\u00f6\u00f6tanud kolmandate osapoolte tarnija Avocent (praegu Vertivi osa). <\/p>\n

Esimene haavatavus tuleneb kr\u00fcptograafilise kontrollimise puudumisest laaditavatel p\u00fcsivara v\u00e4rskendustel (kasutatakse vaid CRC32 kontrollsumma kontrolli, mis on vastuolus soovitused<\/a><\/noindex> NIST digitaalsete allkirjade kasutamisega), mis v\u00f5imaldab r\u00fcndajal, kellel on kohalik juurdep\u00e4\u00e4s s\u00fcsteemile, BMC p\u00fcsivara asendada. Probleemi saab n\u00e4iteks kasutada rootkit'i s\u00fcgava integreerimise jaoks, mis j\u00e4\u00e4b aktiivseks p\u00e4rast operatsioonis\u00fcsteemi uuendamist ja blokeerib edasised p\u00fcsivara v\u00e4rskendused (rootkit'ist vabanemiseks on vajalik SPI flash'i \u00fclekirjutamiseks programmeerija kasutamine).<\/p>\n

Teine haavatavus esineb p\u00fcsivara v\u00e4rskenduse koodis ja v\u00f5imaldab oma k\u00e4ske sisestada, mis k\u00e4ivitatakse BMC-s k\u00f5rgeima privileegitasemega. R\u00fcnnaku jaoks piisab, kui muuta RemoteFirmwareImageFilePath parameetri v\u00e4\u00e4rtust bmcfwu.cfg konfiguratsioonifailis, milles m\u00e4\u00e4ratletakse v\u00e4rskendatava p\u00fcsivara pilt. J\u00e4rgneva v\u00e4rskendamise ajal, mida saab k\u00e4ivitada k\u00e4sklusega IPMI-s, t\u00f6\u00f6deldakse seda parameetrit BMC-s ja kasutatakse popen() kutsumise osana failiteel \/bin\/sh. Kuna shell-k\u00e4skude genereerimise rida luuakse snprintf() kutsumise abil ilma erim\u00e4rkide n\u00f5uetekohase puhastamiseta, saavad r\u00fcndajad sisestada oma koodi k\u00e4itamiseks. Haavatavuse ekspluateerimiseks on vajalikud \u00f5igused, mis v\u00f5imaldavad IPMI kaudu k\u00e4sku BMC kontrollerile saata (olemasoleva administraatori \u00f5igustega serveris saab IPMI k\u00e4sku saata ilma t\u00e4iendava autentimiseta).<\/p>\n

Gigabyte ja Lenovo said probleemidest teada juba juulis 2018 ja suudsid enne avaliku teabe avalikustamist v\u00e4lja anda v\u00e4rskendusi. Ettev\u00f5te Lenovo vabastas<\/a><\/noindex> v\u00e4lja andnud 15. novembril 2018 j\u00e4rgmistel serveritel ThinkServer RD340, TD340, RD440, RD540 ja RD640, kuid k\u00f5rvaldas neist ainult haavatavuse, mis v\u00f5imaldas k\u00e4skude s\u00fcstimise, kuna 2014. aastal MergePoint EMS baasil serverite seeria loomise ajal ei olnud spetsiaalsete digitaalsete allkirjade verifitseerimine veel laialt levinud ja algselt see ei olnud v\u00e4lja kuulutatud.<\/p>\n

8. mail sel aastal kehitas Gigabyte v\u00e4lja v\u00e4rskendused emaplaatide jaoks, millel on ASPEED AST2500 kontroller, kuid nagu Lenovo, k\u00f5rvaldas ta ainult k\u00e4skude s\u00fcstimisega seotud haavatavuse. Haavatavad emaplaanid ASPEED AST2400 baasil j\u00e4\u00e4vad v\u00e4rskendusteta. Gigabyte , et IPv4-aadressid saavad otsa l\u00e4hip\u00e4evil. \u00dcldiselt osutus tema prognoos \u00fcllatavalt t\u00e4pseks.<\/a><\/noindex> \u00fcleminekust MegaRAC SP-X p\u00fcsivara kasutamisele AMI-lt. Uued MegaRAC SP-X baasil p\u00fcsivara versioonid pakutakse ka s\u00fcsteemidele, mis varem tarniti MergePoint EMS p\u00fcsivaraga. Otsus tehti p\u00e4rast Vertiv'i teadet MergePoint EMS platvormi toetamise l\u00f5petamisest. Nende seas ei ole hetkel teateid v\u00e4rskendustest serverite p\u00fcsivara osas, mida toodavad ettev\u00f5tted Acer, AMAX, Bigtera, Ciara, Penguin Computing ja sysGen Gigabyte emaplaatidel ja haavatava MergePoint EMS p\u00fcsivaraga.<\/p>\n

Tuletame meelde, et BMC on serverites installitav spetsialiseeritud kontroller, millel on oma CPU, m\u00e4lu, salvestus ja andurite k\u00fcsitlemise liidesed, mis pakub madala taseme liidese serveritehnika j\u00e4lgimiseks ja haldamiseks. BMC-d kasutades saab olenemata serveris t\u00f6\u00f6tavast ops\u00fcsteemist j\u00e4lgida andurite seisukorda, hallata toidet, p\u00fcsivara ja kettaid, korraldada kaugloldimist ja tagada kaugjuhtimiskonsooli t\u00f6\u00f6d jne.<\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Lenovo ThinkServer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 BMC. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Gigabyte Enterprise Servers, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0430\u043a Acer, AMAX, Bigtera, Ciara, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36271","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47BMC-kontrollerite p\u00fcsivara haavatavus, mis m\u00f5jutab paljude tootjate servereid | ProHoster","description":"Eclypsium avastas BMC-kontrolleri p\u00fcsivara kahe haavatavuse.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:10:36+00:00","article:modified_time":"2019-10-31T19:10:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36271","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:18","updated":"2026-01-22 02:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=36271"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/36271\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=36271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=36271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=36271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}