{"id":36271,"date":"2019-10-31T22:10:36","date_gmt":"2019-10-31T19:10:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\/"},"modified":"2019-10-31T22:10:36","modified_gmt":"2019-10-31T19:10:36","slug":"uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","title":{"rendered":"En s\u00e5rbarhet i firmware f\u00f6r BMC-kontroller som p\u00e5verkar servrar fr\u00e5n m\u00e5nga tillverkare","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>F\u00f6retaget Eclypsium <noindex><a rel=\"nofollow\" href=\"https:\/\/eclypsium.com\/2019\/07\/16\/vulnerable-firmware-in-the-supply-chain-of-enterprise-servers\/\">har identifierat<\/a><\/noindex> tv\u00e5 s\u00e5rbarheter i BMC-kontroller firmware som levereras med Lenovo ThinkServer-servrar, vilket g\u00f6r det m\u00f6jligt f\u00f6r en lokal anv\u00e4ndare att byta firmware eller k\u00f6ra godtycklig kod p\u00e5 BMC-chippet.<\/p>\n<p>En vidare granskning visade att dessa problem \u00e4ven p\u00e5verkar firmware f\u00f6r BMC-kontroller som anv\u00e4nds i Gigabyte Enterprise Servers, som ocks\u00e5 anv\u00e4nds i servrar fr\u00e5n f\u00f6retag som Acer, AMAX, Bigtera, Ciara, Penguin Computing och sysGen. I de problematiska BMC-kontrollerna anv\u00e4ndes s\u00e5rbar firmware MergePoint EMS, utvecklad av tredjepartsleverant\u00f6ren Avocent (numera en del av Vertiv). <\/p>\n<p>Den f\u00f6rsta s\u00e5rbarheten orsakas av bristen p\u00e5 kryptografisk verifiering av laddade firmwareuppdateringar (endast CRC32-kontroll anv\u00e4nds, i strid med <noindex><a rel=\"nofollow\" href=\"https:\/\/nvlpubs.nist.gov\/nistpubs\/SpecialPublications\/NIST.SP.800-193.pdf\">rekommendationerna<\/a><\/noindex> NIST:s anv\u00e4ndning av digitala signaturer), vilket g\u00f6r det m\u00f6jligt f\u00f6r en angripare med lokal \u00e5tkomst till systemet att byta ut BMC-firmware. Problemet kan, till exempel, anv\u00e4ndas f\u00f6r att djupt integrera en rootkit som f\u00f6rblir aktiv efter ominstallation av operativsystemet och blockerar framtida firmwareuppdateringar (f\u00f6r att ta bort rootkit beh\u00f6vs en programmerare f\u00f6r att skriva om SPI-flash).<\/p>\n<p>Den andra s\u00e5rbarheten finns i firmwareuppdateringskoden och g\u00f6r att angripare kan injicera egna kommandon som kommer att k\u00f6ras i BMC med h\u00f6gsta privilegier. F\u00f6r attacken r\u00e4cker det att \u00e4ndra v\u00e4rdet av parameter RemoteFirmwareImageFilePath i konfigurationsfilen bmcfwu.cfg, genom vilken s\u00f6kv\u00e4gen till den uppdaterade firmwareavbildningen definieras. Under n\u00e4sta uppdatering, som kan initieras med ett kommando i IPMI, kommer denna parameter att bearbetas av BMC och anv\u00e4ndas i ett popen()-anrop som en del av str\u00e4ngen f\u00f6r \/bin\/sh. Eftersom str\u00e4ngen f\u00f6r att skapa shell-kommandot genereras med anropet snprintf() utan korrekt rensning av specialtecken, kan angripare injicera sin egen kod f\u00f6r utf\u00f6rande. F\u00f6r att utnyttja s\u00e5rbarheten kr\u00e4vs r\u00e4ttigheter som g\u00f6r det m\u00f6jligt att skicka ett kommando till BMC-kontrollern via IPMI (med administratorr\u00e4ttigheter p\u00e5 servern kan ett IPMI-kommando skickas utan ytterligare autentisering).<\/p>\n<p>F\u00f6retagen Gigabyte och Lenovo informerades om problemen redan i juli 2018 och lyckades sl\u00e4ppa uppdateringar innan den offentliga avsl\u00f6jandet. F\u00f6retaget Lenovo <noindex><a rel=\"nofollow\" href=\"https:\/\/support.lenovo.com\/ru\/ru\/solutions\/len-23836\">har sl\u00e4ppt<\/a><\/noindex> sl\u00e4ppte firmware-uppdateringar den 15 november 2018 f\u00f6r serverarna ThinkServer RD340, TD340, RD440, RD540 och RD640, men \u00e5tg\u00e4rdade endast s\u00e5rbarheten som m\u00f6jligg\u00f6r kommandoinjektion, eftersom verifiering av firmware med digitala signaturer inte var allm\u00e4nt utbrett och fr\u00e5n b\u00f6rjan inte angetts vid skapandet av serverlinjen baserad p\u00e5 MergePoint EMS 2014.<\/p>\n<p>Den 8 maj i \u00e5r sl\u00e4ppte Gigabyte firmware-uppdateringar f\u00f6r moderkort med ASPEED AST2500-kontroller, men liksom Lenovo \u00e5tg\u00e4rdade de endast s\u00e5rbarheten relaterad till kommandoinjektion. De s\u00e5rbara moderkorten baserade p\u00e5 ASPEED AST2400 har \u00e4nnu inte f\u00e5tt uppdatering. Gigabyte meddelade ocks\u00e5 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gigabyte.com\/pr\/Press\/News\/1700\">uttalade<\/a><\/noindex> \u00f6verg\u00e5ngen till anv\u00e4ndningen av MegaRAC SP-X-firmware fr\u00e5n AMI. De nya firmware p\u00e5 MegaRAC SP-X-basis kommer \u00e4ven att erbjudas f\u00f6r system som tidigare levererades med MergePoint EMS-firmware. Beslutet fattades efter Vertivs meddelande om att de slutar st\u00f6dja MergePoint EMS-plattformen. F\u00f6r tillf\u00e4llet har inget meddelats om firmwareuppdateringar f\u00f6r servrar tillverkade av Acer, AMAX, Bigtera, Ciara, Penguin Computing och sysGen baserade p\u00e5 Gigabyte-moderkort och utrustade med s\u00e5rbar MergePoint EMS-firmware.<\/p>\n<p>Det b\u00f6r p\u00e5minnas om att BMC representerar en specialiserad controller installerad i servrar, som har sin egen CPU, minne, lagring och gr\u00e4nssnitt f\u00f6r sensoravl\u00e4sning, och som ger ett l\u00e5g-niv\u00e5 gr\u00e4nssnitt f\u00f6r \u00f6vervakning och hantering av serverutrustning. Genom BMC kan man oavsett vilket operativsystem som k\u00f6rs p\u00e5 servern \u00f6vervaka status av sensorer, hantera str\u00f6mf\u00f6rs\u00f6rjning, firmware och diskar, organisera fj\u00e4rrstart \u00f6ver n\u00e4tverket, samt s\u00e4kerst\u00e4lla funktionaliteten hos fj\u00e4rr\u00e5tkomstkonsolen osv.<\/p>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>K\u00e4lla: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51118\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 Lenovo ThinkServer, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0443 \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0447\u0438\u043f\u0430 BMC. \u0414\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u043f\u043e\u043a\u0430\u0437\u0430\u043b, \u0447\u0442\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u044b\u0435 \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430\u0445 Gigabyte Enterprise Servers, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0442\u0430\u043a\u0438\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0430\u043a Acer, AMAX, Bigtera, Ciara, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-36271","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sv_SE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:10:36+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:10:36+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47S\u00e5rbarhet i BMC-kontrollerens firmware, som p\u00e5verkar servrar fr\u00e5n m\u00e5nga tillverkare | ProHoster","description":"F\u00f6retaget Eclypsium har uppt\u00e4ckt tv\u00e5 s\u00e5rbarheter i BMC-kontrollerens firmware.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0430\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u044b \u043c\u043d\u043e\u0433\u0438\u0445 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u0439 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Eclypsium \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/uyazvimost-v-proshivkah-bmc-kontrollerov-zatragivayushhaya-servery-mnogih-proizvoditelej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:10:36+00:00","article:modified_time":"2019-10-31T19:10:36+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"36271","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 02:38:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:33:18","updated":"2026-01-22 02:38:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/36271","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=36271"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/36271\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=36271"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=36271"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=36271"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}