{"id":36271,"date":"2019-10-31T22:10:36","date_gmt":"2019-10-31T19:10:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\/"},"modified":"2019-10-31T22:10:36","modified_gmt":"2019-10-31T19:10:36","slug":"uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","title":{"rendered":"Vulnerabilidade nos firmwares dos controladores BMC, afetando servidores de muitos fabricantes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Eclypsium expose<\/a><\/noindex> duas vulnerabilidades nos firmwares do controlador BMC fornecido em servidores Lenovo ThinkServer, permitindo que um usu\u00e1rio local substitua o firmware ou execute c\u00f3digo arbitr\u00e1rio no lado do chip BMC.<\/p>\n

Uma an\u00e1lise adicional mostrou que esses problemas tamb\u00e9m afetam os firmwares dos controladores BMC utilizados nas plataformas de servidor Gigabyte Enterprise Servers, que tamb\u00e9m s\u00e3o usadas em servidores de empresas como Acer, AMAX, Bigtera, Ciara, Penguin Computing e sysGen. Nos controladores BMC problem\u00e1ticos, foram utilizados firmwares vulner\u00e1veis MergePoint EMS, desenvolvidos por um fornecedor externo Avocent (atualmente uma subsidi\u00e1ria da Vertiv). <\/p>\n

A primeira vulnerabilidade \u00e9 causada pela falta de verifica\u00e7\u00e3o criptogr\u00e1fica das atualiza\u00e7\u00f5es de firmware carregadas (apenas a verifica\u00e7\u00e3o do CRC32 \u00e9 utilizada, em contrariedade \u00e0s recomenda\u00e7\u00f5es<\/a><\/noindex> do NIST de usar assinaturas digitais), o que permite que um atacante com acesso local ao sistema substitua o firmware BMC. A falha, por exemplo, pode ser usada para uma profunda integra\u00e7\u00e3o de rootkit, que permanece ativo ap\u00f3s a reinstala\u00e7\u00e3o do sistema operacional e bloqueia futuras atualiza\u00e7\u00f5es de firmware (para remover o rootkit, \u00e9 necess\u00e1rio usar um programador para regravar o SPI flash).<\/p>\n

A segunda vulnerabilidade est\u00e1 presente no c\u00f3digo de atualiza\u00e7\u00e3o do firmware e permite a inser\u00e7\u00e3o de seus pr\u00f3prios comandos, que ser\u00e3o executados no BMC com o mais alto n\u00edvel de privil\u00e9gios. Para o ataque, basta modificar o valor do par\u00e2metro RemoteFirmwareImageFilePath no arquivo de configura\u00e7\u00e3o bmcfwu.cfg, que determina o caminho para a imagem do firmware a ser atualizado. Durante a pr\u00f3xima atualiza\u00e7\u00e3o, que pode ser iniciada por um comando no IPMI, esse par\u00e2metro ser\u00e1 processado pelo BMC e usado na chamada popen() como parte da string para \/bin\/sh. Como a string para formar o comando shell \u00e9 criada usando a chamada snprintf() sem a devida limpeza de caracteres especiais, os atacantes podem injetar seu c\u00f3digo para execu\u00e7\u00e3o. Para explorar a vulnerabilidade, \u00e9 necess\u00e1rio ter permiss\u00f5es que permitam enviar um comando ao controlador BMC via IPMI (tendo privil\u00e9gios de administrador no servidor, \u00e9 poss\u00edvel enviar um comando IPMI sem autentica\u00e7\u00e3o adicional).<\/p>\n

As empresas Gigabyte e Lenovo foram informadas sobre os problemas em julho de 2018 e conseguiram lan\u00e7ar atualiza\u00e7\u00f5es antes da divulga\u00e7\u00e3o p\u00fablica das informa\u00e7\u00f5es. A empresa Lenovo lan\u00e7ou<\/a><\/noindex> lan\u00e7ou atualiza\u00e7\u00f5es de firmware em 15 de novembro de 2018 para os servidores ThinkServer RD340, TD340, RD440, RD540 e RD640, mas corrigiu apenas a vulnerabilidade que permitia a inje\u00e7\u00e3o de comandos, pois durante a cria\u00e7\u00e3o da linha de servidores com base no MergePoint EMS em 2014 a verifica\u00e7\u00e3o de firmware por assinatura digital ainda n\u00e3o era amplamente utilizada e n\u00e3o foi inicialmente declarada.<\/p>\n

Em 8 de maio deste ano, a Gigabyte lan\u00e7ou atualiza\u00e7\u00f5es de firmware para placas-m\u00e3e com controlador ASPEED AST2500, mas assim como a Lenovo, corrigiu apenas a vulnerabilidade relacionada \u00e0 inje\u00e7\u00e3o de comandos. As placas vulner\u00e1veis com base no ASPEED AST2400 ainda permanecem sem atualiza\u00e7\u00e3o. A Gigabyte tamb\u00e9m afirmou<\/a><\/noindex> est\u00e1 fazendo a transi\u00e7\u00e3o para o uso de firmwares MegaRAC SP-X da AMI. Isso inclui novos firmwares com base no MegaRAC SP-X que ser\u00e3o oferecidos para sistemas anteriormente fornecidos com firmwares MergePoint EMS. A decis\u00e3o foi tomada ap\u00f3s o an\u00fancio da Vertiv sobre a interrup\u00e7\u00e3o do suporte \u00e0 plataforma MergePoint EMS. No entanto, at\u00e9 o momento, n\u00e3o h\u00e1 informa\u00e7\u00f5es sobre atualiza\u00e7\u00f5es de firmware para servidores fabricados pelas empresas Acer, AMAX, Bigtera, Ciara, Penguin Computing e sysGen, que utilizam placas Gigabyte e est\u00e3o equipados com firmwares vulner\u00e1veis MergePoint EMS.<\/p>\n

Lembrando que o BMC \u00e9 um controlador especializado instalado em servidores, que possui sua pr\u00f3pria CPU, mem\u00f3ria, armazenamento e interfaces de consulta de sensores, proporcionando uma interface de baixo n\u00edvel para monitoramento e gerenciamento de hardware de servidor. Com o BMC, independentemente do sistema operacional que esteja em execu\u00e7\u00e3o no servidor, \u00e9 poss\u00edvel monitorar o status dos sensores, gerenciar energia, firmwares e discos, organizar inicializa\u00e7\u00e3o remota pela rede, garantir o funcionamento da console de acesso remoto, entre outros.<\/p>\n

<\/a><\/noindex><\/p>\n

Fonte: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Lenovo ThinkServer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 BMC. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Gigabyte Enterprise Servers, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0430\u043a Acer, AMAX, Bigtera, Ciara, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36271","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidade nos firmwares dos controladores BMC, afetando servidores de v\u00e1rios fabricantes | ProHoster","description":"A empresa Eclypsium identificou duas vulnerabilidades nos firmwares do controlador BMC.","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/pt\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:10:36+00:00","article:modified_time":"2019-10-31T19:10:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36271","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:18","updated":"2026-01-22 02:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/36271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=36271"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/36271\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=36271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=36271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=36271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}