{"id":36271,"date":"2019-10-31T22:10:36","date_gmt":"2019-10-31T19:10:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\/"},"modified":"2019-10-31T22:10:36","modified_gmt":"2019-10-31T19:10:36","slug":"uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","title":{"rendered":"Vulnerabilitate \u00een firmware-urile controlerelor BMC, afect\u00e2nd serverele mai multor produc\u0103tori","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Compania Eclypsium a eviden\u021biat<\/a><\/noindex> dou\u0103 vulnerabilit\u0103\u021bi \u00een firmware-urile controlerului BMC livrat \u00een serverele Lenovo ThinkServer, care permit unui utilizator local s\u0103 \u00eenlocuiasc\u0103 firmware-ul sau s\u0103 execute cod arbitrar pe cipul BMC.<\/p>\n

O analiz\u0103 suplimentar\u0103 a ar\u0103tat c\u0103 aceste probleme afecteaz\u0103 \u0219i firmware-urile controlerelor BMC utilizate pe platformele server Gigabyte Enterprise Servers, care sunt de asemenea folosite \u00een serverele unor companii precum Acer, AMAX, Bigtera, Ciara, Penguin Computing \u0219i sysGen. \u00cen controlerele BMC problematice au fost utilizate firmware-uri vulnerabile MergePoint EMS, dezvoltate de furnizorul ter\u021b Avocent (\u00een prezent o subsidiar\u0103 a companiei Vertiv). <\/p>\n

Prima vulnerabilitate este cauzat\u0103 de lipsa unei verific\u0103ri criptografice a actualiz\u0103rilor de firmware \u00eenc\u0103rcate (fiind utilizat\u0103 doar verificarea checksum-ului CRC32, contrar recomand\u0103ri<\/a><\/noindex> NIST de a folosi semn\u0103turi digitale), permi\u021b\u00e2nd unui atacator cu acces local la sistem s\u0103 \u00eenlocuiasc\u0103 firmware-ul BMC. Problema, de exemplu, poate fi utilizat\u0103 pentru o integrare profund\u0103 a unui rootkit, care r\u0103m\u00e2ne activ dup\u0103 reinstalarea sistemului de operare \u0219i blocheaz\u0103 actualiz\u0103rile de firmware ulterioare (pentru a elimina rootkitul este necesar\u0103 utilizarea unui programator pentru a rescrie flash-ul SPI).<\/p>\n

A doua vulnerabilitate este prezent\u0103 \u00een codul de actualizare a firmware-ului \u0219i permite substituirea comenzilor proprii, care vor fi executate \u00een BMC cu cel mai \u00eenalt nivel de privilegii. Pentru atac, este suficient s\u0103 modifica\u021bi valoarea parametrului RemoteFirmwareImageFilePath \u00een fi\u0219ierul de configurare bmcfwu.cfg, prin care se define\u0219te calea c\u0103tre imaginea firmware-ului actualizabil. \u00cen timpul urm\u0103toarei actualiz\u0103ri, care poate fi ini\u021biat\u0103 printr-o comand\u0103 \u00een IPMI, acest parametru va fi procesat de BMC \u0219i utilizat \u00een cadrul apelului popen() ca parte a \u0219irului pentru \/bin\/sh. Deoarece \u0219irul pentru formarea comenzii shell este creat folosind apelul snprintf() f\u0103r\u0103 o cur\u0103\u021bare adecvat\u0103 a caracterelor speciale, atacatorii pot insera propriul cod pentru a fi executat. Pentru exploatarea vulnerabilit\u0103\u021bii este necesare drepturi care permit trimiterea unei comenzi c\u0103tre controlerul BMC prin IPMI (dac\u0103 exist\u0103 drepturi de administrator pe server, se poate trimite o comand\u0103 IPMI f\u0103r\u0103 autentificare suplimentar\u0103).<\/p>\n

Companiile Gigabyte \u0219i Lenovo au fost informate despre probleme \u00eenc\u0103 din iulie 2018 \u0219i au reu\u0219it s\u0103 emit\u0103 actualiz\u0103ri \u00eenainte de dezv\u0103luirea public\u0103 a informa\u021biilor. Compania Lenovo a lansat<\/a><\/noindex> a lansat actualiz\u0103ri ale firmware-ului pe 15 noiembrie 2018 pentru serverele ThinkServer RD340, TD340, RD440, RD540 \u0219i RD640, dar a remediat doar vulnerabilitatea care permitea injectarea de comenzi, deoarece \u00een timpul cre\u0103rii liniei de servere bazate pe MergePoint EMS \u00een 2014, verificarea firmware-ului prin semn\u0103tur\u0103 digital\u0103 nu era \u00eenc\u0103 larg r\u0103sp\u00e2ndit\u0103 \u0219i nu a fost declarat\u0103 ini\u021bial.<\/p>\n

Pe 8 mai anul acesta, compania Gigabyte a lansat actualiz\u0103ri ale firmware-ului pentru pl\u0103cile de baz\u0103 cu controler ASPEED AST2500, dar ca \u0219i Lenovo a remediat doar vulnerabilitatea legat\u0103 de injectarea de comenzi. Pl\u0103cile vulnerabile bazate pe ASPEED AST2400 r\u0103m\u00e2n \u00eenc\u0103 f\u0103r\u0103 actualizare. Gigabyte de asemenea a declarat<\/a><\/noindex> a trecut la utilizarea firmware-urilor MegaRAC SP-X de la compania AMI. De asemenea, noile firmware-uri bazate pe MegaRAC SP-X vor fi oferite pentru sistemele care au fost anterior livrate cu firmware-uri MergePoint EMS. Decizia a fost luat\u0103 dup\u0103 anun\u021bul Vertiv privind \u00eencheierea suportului pentru platforma MergePoint EMS. Totodat\u0103, nu s-au f\u0103cut anun\u021buri privind actualizarea firmware-urilor pe serverele produse de companiile Acer, AMAX, Bigtera, Ciara, Penguin Computing \u0219i sysGen bazate pe pl\u0103cile Gigabyte \u0219i echipate cu firmware-uri vulnerabile MergePoint EMS.<\/p>\n

Reamintim c\u0103 BMC reprezint\u0103 un controler specializat instalat \u00een servere, av\u00e2nd propriul CPU, memorie, stocare \u0219i interfe\u021be pentru interogarea senzorilor, care ofer\u0103 o interfa\u021b\u0103 de nivel inferior pentru monitorizarea \u0219i gestionarea echipamentului serverului. Cu ajutorul BMC-ului, indiferent de sistemul de operare care ruleaz\u0103 pe server, se poate monitoriza starea senzorilor, gestiona energia, firmware-urile \u0219i discurile, organiza o \u00eenc\u0103rcare de la distan\u021b\u0103 prin re\u021bea, asigura func\u021bionarea consolei de acces la distan\u021b\u0103 etc.<\/p>\n

<\/a><\/noindex><\/p>\n

Sursa: opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Lenovo ThinkServer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 BMC. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Gigabyte Enterprise Servers, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0430\u043a Acer, AMAX, Bigtera, Ciara, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36271","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilitate \u00een firmware-urile controlerelor BMC, afect\u00e2nd serverele multor produc\u0103tori | ProHoster","description":"Compania Eclypsium a identificat dou\u0103 vulnerabilit\u0103\u021bi \u00een firmware-urile controlerului BMC.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:10:36+00:00","article:modified_time":"2019-10-31T19:10:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36271","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:18","updated":"2026-01-22 02:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=36271"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/36271\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=36271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=36271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=36271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}