Supermicro IPMI based on ATEN firmware contain multiple vulnerabilities

Overview Supermicro Intelligent Platform Management Interface IPMI implementations based on ATEN firmware contain multiple vulnerabilities in their web management interface. Description CWE-121: Stack-based Buffer Overflow - CVE-2013-3607The Supermicro IPMI web interface contains multiple buffer...

[security bulletin] HPSBMU02902 rev.1 - HP Integrated Lights-Out iLO3, iLO4 IPMI Cipher Suite 0 Authentication Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03844348 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03844348 Version: 1 HPSBMU02902 rev....

CVE-2013-4031

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers has a default password for the IPMI user account, which makes it easier for...

CVE-2013-4038

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading...

Default credentials

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers has a default password for the IPMI user account, which makes it easier for...

Design/Logic Flaw

The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...

CVE-2013-4031

The CVE-2013-4031 issue affects IBM/Lenovo IMM/IMM2 IPMI implementations where a single preconfigured IPMI user account uses default credentials across affected systems (IBM BladeCenter, Flex System, System x iDataPlex, System x3###; Lenovo IMM/IMM2/TSM). The root cause is the presence of a defau...

CVE-2013-4037

The CVE-2013-4037 issue concerns the RAKP-based authentication in IPMI on IBM/Lenovo IMM and IMM2 (various BladeCenter, Flex System, System x IMM/IMM2 platforms). The RAKP flow transmits a password hash to the client, enabling offline brute‑force/dictionary attacks to recover credentials. IBM’s a...

CVE-2013-4031

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers has a default password for the IPMI user account, which makes it easier for...

CVE-2013-4038

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading...

CVE-2013-4038

The CVE-2013-4038 issue affects IBM IMM/IMM2 IPMI implementations (IBM BladeCenter, Flex System, System x iDataPlex, System x3###). Root cause: passwords for user accounts are stored in clear text in the IMM filesystem, enabling an attacker with access to the IMM OS to view credentials and potent...

IPMI Server Detection (HP Lights-Out)

Binary data 6981.prm...

IPMI Server Detection (SSL Issuer Check)

Binary data 6983.prm...

IPMI Server Detection (Certificate Email Check)

Binary data 6980.prm...

IPMI Server Detection (Dell iDRAC)

Binary data 6982.prm...

IPMI Server Detection (SSL Certificate Check)

Binary data 6985.prm...

IPMI Server Detection (Protocol Check)

Binary data 6951.prm...

IPMI Cipher Suites Supported

Binary data ipmisupportedciphersuites.nbin...

IPMI Cipher Suite Zero Authentication Bypass

Binary data ipmicipher0authbypass.nbin...

Dell iDRAC6 Multiple Vulnerabilities

The remote Dell Integrated Remote Access Controller 6 iDRAC6 is affected by the following vulnerabilities : - A flaw exists in the testurls.html page that allows a remote attacker to authenticate as root. A remote attacker can exploit this to enable root user access over SSH, telnet, and other...