![]() The PoC exploits for the flaw are available at the following URLs:Ī Metasploit module for the flaw is available here. The experts presented their findings at some security conferences, including the ReCon Brussels (Slides, research paper ) and SSTIC 18. The flaw affects HP iLO 4 servers running firmware version prior to 2.53. The good news is that HP addressed the flaw in August 2017 with the release of the iLO 4 firmware version 2.54, for this reason, system administrators need to upgrade their servers. HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Out. In the following images, the experts demonstrate how to bypass iLO authentication, in this case how to retrieve a local user’s password in cleartext. A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). The experts discovered that it is possible to exploit issue by using a cURL request and 29 letter “A” characters:Ĭurl -H "Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA" The flaw could be exploited by a remote authenticated attack to access to HP iLO consoles, extract cleartext passwords, execute malware, and even replace iLO firmware. The flaw was discovered by three security researchers (Fabien Périgaud from Synacktiv, Alexandre Gazet from Airbus, and the independent security researcher Joffrey Czarny) last year and potentially expose any iLO servers exposed online at risk. ILO cards allow administrators to perform a broad range of management activities in a company network, including to install firmware remotely and provide access to a remote console. This document provides the product description, features, specifications, and troubleshooting tips for the compute module. ![]() The physical connection is an Ethernet port that can be found on most Proliant servers and microservers of the 300 and above series.” reads Wikipedia. The HPE Synergy 660 Gen10 Compute Module is a powerful and versatile server that delivers high performance and scalability for demanding workloads. “Integrated Lights-Out, or iLO, is a proprietary embedded server management technology by Hewlett-Packard which provides out-of-band management facilities. Bundle Version: 4.2.66 Firmware version: 4.2.66 (2020. The flaw, tracked as CVE-2017-12542, received a severity score of 9.8 out of 10 because it is very simple to exploit. Hewlett Packard Integrated Lights-Out 4 (HP iLO 4) servers are affected by a critical Bypass Authentication vulnerability, technical details and a PoC code have been published online. HP iLO servers running outdated firmware could be remotely hacked
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |