Authorization

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices relies on JavaScript code on the client for authorization checks, which...

CVE-2013-3609

The CVE-2013-3609 issue affects Supermicro IPMI web interfaces (various H8/ X9/X8/X7 series) where client-side JavaScript is used for authorization checks. This reliance on client-side validation may allow remote authenticated users to bypass access restrictions and escalate privileges via crafte...

CVE-2013-3607

The CVE-2013-3607 issue affects Supermicro IPMI, specifically the web interface used by the Baseboard Management Controller (BMC). Multiple stack-based buffer overflows have been identified in the web login.cgi, affecting models such as H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, ...

CVE-2013-3608

The CVE-2013-3608 entry concerns the IPMI web interface in Supermicro devices (e.g., H8DC*/H8DG*/H8SCM-F/H8SGL-F/H8SM*, X7SP*/X8DT*/X8SI*/X9DAX-/X9DB /X9DR*/X9QR*/X9SBAA-F/X9SC*/X9SPU-F/X9SR*) where remote authenticated users can execute arbitrary commands via shell metacharacters in the config_d...

CVE-2013-3607

Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices allow remote attackers to execute...

CVE-2013-3609

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices relies on JavaScript code on the client for authorization checks, which...

CVE-2013-3608

The web interface in the Intelligent Platform Management Interface IPMI implementation on Supermicro H8DC, H8DG, H8SCM-F, H8SGL-F, H8SM, X7SP, X8DT, X8SI, X9DAX-, X9DB, X9DR, X9QR, X9SBAA-F, X9SC, X9SPU-F, and X9SR devices allows remote authenticated users to execute arbitrary commands via shell...

PT-2013-4512

Name of the Vulnerable Software and Affected Versions Supermicro H8DC versions affected versions not specified Supermicro H8DG versions affected versions not specified Supermicro H8SCM-F versions affected versions not specified Supermicro H8SM versions affected versions not specified Supermicro...

PT-2013-4513

Name of the Vulnerable Software and Affected Versions Supermicro IPMI implementation versions affected versions not specified Description The issue affects the web interface in the Intelligent Platform Management Interface IPMI implementation, allowing remote authenticated users to execute...

PT-2013-4514

Name of the Vulnerable Software and Affected Versions Supermicro IPMI implementation versions affected versions not specified Description The issue concerns the web interface in the Intelligent Platform Management Interface IPMI implementation, where authorization checks rely on JavaScript code o...

Foreman: hosts_controller.rb power/ipmi_boot Symbol creation DoS

The 1 power and 2 ipmiboot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service memory consumption via unspecified input that is converted to a symbol...

Supermicro IPMI based on ATEN firmware contain multiple vulnerabilities

Overview Supermicro Intelligent Platform Management Interface IPMI implementations based on ATEN firmware contain multiple vulnerabilities in their web management interface. Description CWE-121: Stack-based Buffer Overflow - CVE-2013-3607The Supermicro IPMI web interface contains multiple buffer...

[security bulletin] HPSBMU02902 rev.1 - HP Integrated Lights-Out iLO3, iLO4 IPMI Cipher Suite 0 Authentication Bypass Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: the current version of the following document is available here: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/ docDisplay?docId=emrna-c03844348 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c03844348 Version: 1 HPSBMU02902 rev....

CVE-2013-4031

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers has a default password for the IPMI user account, which makes it easier for...

CVE-2013-4038

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading...

Default credentials

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers has a default password for the IPMI user account, which makes it easier for...

Design/Logic Flaw

The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...

CVE-2013-4038

The CVE-2013-4038 issue affects IBM IMM/IMM2 IPMI implementations (IBM BladeCenter, Flex System, System x iDataPlex, System x3###). Root cause: passwords for user accounts are stored in clear text in the IMM filesystem, enabling an attacker with access to the IMM OS to view credentials and potent...

CVE-2013-4038

The Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers uses cleartext for password storage, which allows context-dependent attackers to obtain sensitive information by reading...

CVE-2013-4031

The CVE-2013-4031 issue affects IBM/Lenovo IMM/IMM2 IPMI implementations where a single preconfigured IPMI user account uses default credentials across affected systems (IBM BladeCenter, Flex System, System x iDataPlex, System x3###; Lenovo IMM/IMM2/TSM). The root cause is the presence of a defau...