{"id":36271,"date":"2019-10-31T22:10:36","date_gmt":"2019-10-31T19:10:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\/"},"modified":"2019-10-31T22:10:36","modified_gmt":"2019-10-31T19:10:36","slug":"uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","title":{"rendered":"Vulnerability in BMC controller firmware affecting servers from many manufacturers","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Eclypsium ujawnili<\/a><\/noindex> Two vulnerabilities in the BMC controller firmware supplied in Lenovo ThinkServer servers allow a local user to replace the firmware or execute arbitrary code on the BMC chip.<\/p>\n

Further analysis revealed that these issues also affect BMC controller firmware used in Gigabyte Enterprise Servers, which are also utilized in servers from companies such as Acer, AMAX, Bigtera, Ciara, Penguin Computing, and sysGen. The problematic BMC controllers used vulnerable MergePoint EMS firmware developed by a third-party supplier, Avocent (now a division of Vertiv). <\/p>\n

The first vulnerability is caused by the lack of cryptographic verification of loaded firmware updates (only CRC32 checksum verification is used, contrary to zalece\u0144<\/a><\/noindex> NIST's use of digital signatures), allowing an attacker with local access to the system to replace the BMC firmware. This issue can be exploited for deep integration of a rootkit that remains active after the operating system is reinstalled and blocks further firmware updates (removing the rootkit requires the use of a programmer to overwrite SPI flash).<\/p>\n

The second vulnerability lies in the firmware update code and allows the substitution of commands that will be executed in the BMC with the highest privilege level. To carry out the attack, it is sufficient to change the value of the RemoteFirmwareImageFilePath parameter in the bmcfwu.cfg configuration file, which defines the path to the firmware image being updated. During the next update, which can be initiated by a command in IPMI, this parameter will be processed by the BMC and used in the popen() call as part of the string for \/bin\/sh. Since the string for forming the shell command is created using snprintf() without proper special character cleaning, attackers can inject their code for execution. Exploiting this vulnerability requires permissions to send a command to the BMC controller through IPMI (if the server has administrator rights, an IPMI command can be sent without additional authentication).<\/p>\n

Firmy Gigabyte i Lenovo zosta\u0142y poinformowane o problemach ju\u017c w lipcu 2018 roku i zd\u0105\u017cy\u0142y wyda\u0107 aktualizacje przed publicznym ujawnieniem informacji. Firma Lenovo wyda\u0142a<\/a><\/noindex> wyda\u0142a aktualizacje oprogramowania 15 listopada 2018 roku dla serwer\u00f3w ThinkServer RD340, TD340, RD440, RD540 i RD640, ale usun\u0119\u0142a w nich jedynie podatno\u015b\u0107 umo\u017cliwiaj\u0105c\u0105 wstrzykiwanie polece\u0144, poniewa\u017c podczas tworzenia linii serwer\u00f3w opartych na MergePoint EMS w 2014 roku weryfikacja oprogramowania za pomoc\u0105 podpisu cyfrowego nie by\u0142a jeszcze powszechnie stosowana i nie by\u0142a pierwotnie deklarowana.<\/p>\n

8 maja tego roku firma Gigabyte wyda\u0142a aktualizacje oprogramowania dla p\u0142yt g\u0142\u00f3wnych z kontrolerem ASPEED AST2500, ale podobnie jak Lenovo usun\u0119\u0142a jedynie podatno\u015b\u0107 zwi\u0105zan\u0105 z wstrzykiwaniem polece\u0144. Podatne p\u0142yty oparte na ASPEED AST2400 nadal nie maj\u0105 aktualizacji. Gigabyte r\u00f3wnie\u017c stwierdzi\u0142<\/a><\/noindex> przejdzie na korzystanie z oprogramowania MegaRAC SP-X od firmy AMI. Nowe oprogramowanie oparte na MegaRAC SP-X b\u0119dzie r\u00f3wnie\u017c oferowane dla system\u00f3w, kt\u00f3re wcze\u015bniej by\u0142y dostarczane z oprogramowaniem MergePoint EMS. Decyzja ta zosta\u0142a podj\u0119ta po o\u015bwiadczeniu Vertiv o zaprzestaniu wsparcia dla platformy MergePoint EMS. Na razie nie ma informacji o aktualizacji oprogramowania dla serwer\u00f3w produkowanych przez firmy Acer, AMAX, Bigtera, Ciara, Penguin Computing i sysGen, kt\u00f3re s\u0105 oparte na p\u0142ytach Gigabyte i wykorzystuj\u0105 podatne wersje oprogramowania MergePoint EMS.<\/p>\n

Przypominamy, \u017ce BMC to specjalizowany kontroler instalowany w serwerach, kt\u00f3ry posiada w\u0142asny CPU, pami\u0119\u0107, przechowywanie i interfejsy do monitorowania sensor\u00f3w, zapewniaj\u0105cy niski poziom dost\u0119pu do monitorowania i zarz\u0105dzania sprz\u0119tem serwerowym. Dzi\u0119ki BMC, niezale\u017cnie od dzia\u0142aj\u0105cego na serwerze systemu operacyjnego, mo\u017cna monitorowa\u0107 stan sensor\u00f3w, zarz\u0105dza\u0107 zasilaniem, oprogramowaniem i dyskami, zorganizowa\u0107 zdalne uruchamianie przez sie\u0107, zapewni\u0107 dzia\u0142anie konsoli zdalnego dost\u0119pu itd.<\/p>\n

<\/a><\/noindex><\/p>\n

\u0179r\u00f3d\u0142o: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Lenovo ThinkServer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 BMC. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Gigabyte Enterprise Servers, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0430\u043a Acer, AMAX, Bigtera, Ciara, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36271","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Podatno\u015b\u0107 w oprogramowaniu kontroler\u00f3w BMC, dotycz\u0105ca serwer\u00f3w wielu producent\u00f3w | ProHoster","description":"Firma Eclypsium zidentyfikowa\u0142a dwie podatno\u015bci w oprogramowaniu kontrolera BMC.","canonical_url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pl_PL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/pl\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:10:36+00:00","article:modified_time":"2019-10-31T19:10:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36271","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:18","updated":"2026-01-22 02:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/36271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/comments?post=36271"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/posts\/36271\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/media?parent=36271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/categories?post=36271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pl\/wp-json\/wp\/v2\/tags?post=36271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}