Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: InfoSec Handlers Diary Blog InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Rapid7 Discloses IPMI Vulnerabilities

Published: 2013-11-06
Last Updated: 2013-11-06 23:56:46 UTC
by Johannes Ullrich (Version: 1)
3 comment(s)

Rapid7 today disclosed a number of vulnerabilities in Supermicro's IPMI implementation [1]. The vulnerabilities include static encryption keys as well as hard coded, non updatable, passwords. Sadly, these are typical embedded system issues, and not just common in IPMI implementations. In addition, several buffer overflow vulnerabilities are disclosed in CGI programs, some of which are accessible without authentication. For those that require authentication, the hard coded password will provide easy access.

Metasploit modules to test for these vulnerabilities are comming according to the blog post.

There is little one can do to protect an IPMI interface if the interface is needed to remotely administer the system, in particular given the backdoor fixed passwords. The best you can do is limit access to the IPMI interface via a firewall, and maybe by changing default ports if this is an option. Once exposed, an attacker will have the same access to the system as a user with physical system access. Remember that turning off a system may leave IPMI enabled unless you disconnect power or network connectivity. (Hacking Servers that are turned off)

[1] https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities

------
Johannes B. Ullrich, Ph.D.
SANS Technology Institute
Twitter

Keywords: ipmi
3 comment(s)
Check out this month's OUCH! Newsletter to learn about safety in online shopping! http://www.securingthehuman.org/ouch
ISC StormCast for Wednesday, November 6th 2013 http://isc.sans.edu/podcastdetail.html?id=3650
Diary Archives