{"id":91382,"date":"2020-08-12T13:42:03","date_gmt":"2020-08-12T11:42:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3"},"modified":"2020-08-12T13:42:03","modified_gmt":"2020-08-12T11:42:03","slug":"udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sv\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","title":{"rendered":"Fj\u00e4rr s\u00e5rbarhet i serverkort fr\u00e5n Intel med BMC Emulex Pilot 3.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Intel rapporterade<\/a><\/noindex> om \u00e5 \u00e5tg\u00e4rda 22 s\u00e5rbarheter i firmware f\u00f6r sina servermoderkort, serversystem och ber\u00e4kningsmoduler. Tre s\u00e5rbarheter, varav en tilldelats kritisk niv\u00e5, (CVE-2020-8708<\/a><\/noindex> \u2014 CVSS 9.6, CVE-2020-8707<\/a><\/noindex> \u2014 CVSS 8.3, CVE-2020-8706<\/a><\/noindex> \u2014 CVSS 4.7) i LibreSSL.<\/a><\/noindex> i firmware f\u00f6r BMC-kontrollern Emulex Pilot 3, som anv\u00e4nds i Intel-produkter. S\u00e5rbarheterna till\u00e5ter obeh\u00f6rig \u00e5tkomst till konsolen f\u00f6r fj\u00e4rrhantering (KVM) utan autentisering, kringg\u00e5 autentisering vid emulering av USB-lagringsenheter och orsaka en fj\u00e4rr\u00e5tkomstsbuffer\u00f6verskridning i den anv\u00e4nda BMC-k\u00e4rnan i Linux. <\/p>\n

S\u00e5rbarheten CVE-2020-8708 ger en obeh\u00f6rig angripare, som har \u00e5tkomst till samma segment av det lokala n\u00e4tverket som den s\u00e5rbara servern, m\u00f6jlighet att f\u00e5 tillg\u00e5ng till BMC:s styrmilj\u00f6. Det noteras att tekniken f\u00f6r att utnyttja s\u00e5rbarheten \u00e4r mycket enkel och p\u00e5litlig, eftersom problemet beror p\u00e5 en arkitekturfel. Dessutom \u00e4r det ord<\/a><\/noindex> enligt forskaren som identifierade s\u00e5rbarheten enklare att arbeta med BMC via ett exploit \u00e4n med det inbyggda Java-klienten. Bland den drabbade h\u00e5rdvaran n\u00e4mns serverfamiljerna Intel R1000WT, R2000WT, R1000SP, LSVRP, LR1304SP, R1000WF och R2000WF, moderkort S2600WT, S2600CW, S2600KP, S2600TP, S1200SP, S2600WF, S2600ST och S2600BP, samt ber\u00e4kningsmoduler HNS2600KP, HNS2600TP och HNS2600BP. S\u00e5rbarheterna har \u00e5tg\u00e4rdats i firmware-uppdateringen 1.59.<\/p>\n

Enligt icke-officiella data<\/a><\/noindex> firmware f\u00f6r BMC Emulex Pilot 3 har skrivits av AMI, s\u00e5 d\u00e4rf\u00f6r utesluts inte<\/a><\/noindex> kan manifestationer av s\u00e5rbarheterna \u00e4ven f\u00f6rekomma i system fr\u00e5n andra tillverkare. Problemen finns i externa patchar till Linux-k\u00e4rnan och i den anv\u00e4ndarprocess som k\u00f6rs, vars kod har karakt\u00e4riserats av den uppt\u00e4ckande forskaren som den s\u00e4msta kod han har st\u00f6tt p\u00e5.<\/p>\n

Det b\u00f6r p\u00e5minnas om att BMC representerar en specialiserad controller installerad i servrar, som har sin egen CPU, minne, lagring och gr\u00e4nssnitt f\u00f6r sensoravl\u00e4sning, och som ger ett l\u00e5g-niv\u00e5 gr\u00e4nssnitt f\u00f6r \u00f6vervakning och hantering av serverutrustning. Genom BMC kan man oavsett vilket operativsystem som k\u00f6rs p\u00e5 servern \u00f6vervaka status av sensorer, hantera str\u00f6mf\u00f6rs\u00f6rjning, firmware och diskar, organisera fj\u00e4rrstart \u00f6ver n\u00e4tverket, samt s\u00e4kerst\u00e4lla funktionaliteten hos fj\u00e4rr\u00e5tkomstkonsolen osv. <\/p>\n

<\/a><\/noindex><\/p>\n

K\u00e4lla: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 22 \u0443\u044f\u0432\u0437\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043c\u0430\u0442\u0435\u0440\u0438\u043d\u0441\u043a\u0438\u0445 \u043f\u043b\u0430\u0442, \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0438 \u0432\u044b\u0447\u0438\u0441\u043b\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043c\u043e\u0434\u0443\u043b\u0435\u0439. \u0422\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u0440\u0438\u0441\u0432\u043e\u0435\u043d \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c, (CVE-2020-8708 — CVSS 9.6, CVE-2020-8707 — CVSS 8.3, CVE-2020-8706 — CVSS 4.7) \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0435 BMC-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0430 Emulex Pilot 3, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Intel. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-91382","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Fj\u00e4rrs\u00e5rbarhet i Intel-servermoduler med BMC Emulex Pilot 3 | ProHoster","description":"Intel har meddelat att de har \u00e5tg\u00e4rdat 22 s\u00e5rbarheter i firmware f\u00f6r sina servrar.","canonical_url":"https:\/\/prohoster.info\/sv\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sv_SE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0430\u0445 Intel \u0441 BMC Emulex Pilot 3 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Intel \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u0430 \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 22 \u0443\u044f\u0432\u0437\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u0441\u0432\u043e\u0438\u0445 \u0441\u0435\u0440\u0432\u0435\u0440\u043d\u044b\u0445.","og:url":"https:\/\/prohoster.info\/sv\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-platah-intel-s-bmc-emulex-pilot-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-12T11:42:03+00:00","article:modified_time":"2020-08-12T11:42:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"91382","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:28:28","updated":"2022-10-02 06:48:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/91382","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/comments?post=91382"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/posts\/91382\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/media?parent=91382"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/categories?post=91382"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sv\/wp-json\/wp\/v2\/tags?post=91382"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}