SuperMicro IPMI 49152 port password leakage Vulnerability

2014.06.20 SuperMicro IPMI 49152 port password leakage vulnerability was spread by foreign media (http://arstechnica.com/security/2014/06/at-least-32000-servers-broadcast-admin-passwords-in-the-clear-advisory-warns/), the original author also has a detailed description on the blog (http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/), in line with the curious about the vulnerability, this document introduces the vulnerability in Chinese.

 

About IPMI:

The smart platform management interface (IPMI) is an open standard hardware management interface specification that defines specific methods for communication between embedded management subsystems. IPMI information is communicated through the substrate management controller (BMC), which is located on the hardware component of the IPMI specification. IPMI is the abbreviation of Intelligent Platform Management Interface (Intelligent Platform Management Interface). It is an industrial standard used to manage peripheral devices in Enterprise Systems Based on Intel structures, the standards are determined by companies such as Intel, HP, NEC, Dell, and SuperMicro. Please see: http://baike.baidu.com/view/1595174.htm

Simply put, with IPMI, you can use IPMI to monitor the physical health characteristics of servers, such as temperature, voltage, fan operating status, and Power status, more importantly, you can install the system, switch the host, and view the screen output of the operating server, just like standing in front of the server.

IPMI can be managed through the Web. Port 80 is used to enter the management interface. account password authentication is required here. This vulnerability leaks the authentication password information.

Example:

Attackers can obtain the password of port 80 on the web management interface by requesting the/PSBlock file of port 49152 on the server. The password is stored in the PSBlock file, for example, http: // 69. 73. *. *: 49152/PSBlock. Then access http: // 69. 73. *. */logon management.

 

ZoomEye perception:

ZoomEye detects vulnerable hosts around the world and graphically displays them. Links: http://www.zoomeye.org/lab/ipmi

 

Hazards:

Attackers can obtain the management password without authentication, and log on to the IPMI management page. This background has the highest permissions to operate the server-reinstall the system. The consequences can be imagined.

 

Precaution:

1. Contact the manufacturer to upgrade the system;

2. Disable Internet access to port 49152.

Refer:

1. https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi