{"id":40303,"date":"2014-07-02T11:34:39","date_gmt":"2014-07-02T11:34:39","guid":{"rendered":"http:\/\/blog.open-e.com\/?p=40303"},"modified":"2025-07-07T10:37:52","modified_gmt":"2025-07-07T10:37:52","slug":"supermicro-security-update-for-ipmi-bmc-firmware-update-now-and-be-safe","status":"publish","type":"post","link":"https:\/\/www.open-e.com\/blog\/supermicro-security-update-for-ipmi-bmc-firmware-update-now-and-be-safe\/","title":{"rendered":"Supermicro security update for IPMI \/ BMC firmware. Update now and be safe!"},"content":{"rendered":"

\t\t\t\tA new security feature to encrypt passwords is available from Supermicro for systems running IPMI 1.5 & 2.0 protocols and\/or BMC firmware. If you haven’t done so already, please update your firmware as soon as possible.<\/p>\n

\n

The Intelligent Platform Management Interface (IPMI)<\/strong> is a standardized computer system interface used by system administrators for out-of-band management of computer systems and monitoring of their operation. It is a way to manage a computer that may be powered off or otherwise unresponsive by using a network connection to the hardware rather than to an operating system or login shell. An IPMI sub-system consists of a main controller, called the baseboard management controller (BMC)<\/strong> and other management controllers distributed among different system modules that are referred to as satellite controllers<\/p>\n

Source: Wikipedia<\/a><\/strong><\/div>\n<\/div>\n

BMCs in older Supermicro motherboards contain a binary file which stores remote login passwords in plain text. Essentially, if you don’t update your firmware an attacker could gain credentialed access via IPMI on vulnerable systems. This does not pertain to Supermicro’s X10 series motherboards. So, if you are using the newest hardware from Supermicro – no need to update.<\/p>\n

How to check if your system is vulnerable?<\/strong><\/p>\n

If you are using Supermicro servers with IPMI, make sure your storage system is not affected. Check if you are safe by connecting to port 49152 and downloading the file PSBlock, where you will find the exposed password.<\/p>\n

nc IP 49152
\nGET \/PSBlock<\/code><\/div>\n

 <\/p>\n

Potential threat<\/strong><\/p>\n

Having access to IPMI \/ BMC password does not mean that we automatically have access to the root password on a certain server. However, with the help of IPMI we can manage and control the server\u2019s \u2018power state\u2019, BIOS settings and network interface card addresses. In some systems we also have the possibility to run a system from a remotely mounted ISO disk, which can lead to a takeover of superuser\u2019s rights or damage stored data on a server.<\/p>\n

Solution<\/strong><\/p>\n

Supermicro took care of its customers and prepared fixes for this issue. If you were affected you should flash and update\u00a0your firmware as soon as possible.<\/p>\n

You have to keep in mind that this process, when it comes to High Availability<\/a> production environments, can cause unappreciated downtime. In such a case, a better option would be to secure access on dedicated ports associated with IPMI from the side of a router with firewall.<\/p>\n

Protect yourself in the future \u2013 change default passwords and update firmware regularly<\/strong><\/p>\n

On June 20th, 2014 Zachary Wikholm, a senior security engineer at CARInet Security Incident Response Team wrote interesting statistics in regards to this vulnerability: \u201cThere are 31,964 systems that have their passwords available on the open market. It gets a bit scarier when you review some of the password statistics. Out of those passwords, 3296 are the default combination. Since I\u2019m not comfortable providing too much password information, I will just say that there exists a subset of this data that either contains or just was \u201cpassword\u201d.\u201d<\/p>\n

\n

Source:<\/em><\/p>\n