Note: This is an archival copy of Security Sun Alert 239886 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1019460.1.
Sun Fire X2100 M2 Server
Sun Fire X2200 M2 Server
Date of Resolved Release
Security Vulnerabilities in the Embedded Lights Out Manager (ELOM) on Sun Fire X2100 M2 and X2200 M2 may allow Unauthorized Logins
Security vulnerabilities in the Embedded Lights Out Manager (ELOM) on Sun Fire X2100 M2 and X2200 M2 servers may allow remote unprivileged users to gain unauthorized login access with all privileges to the ELOM or execute arbitrary commands on the Service Processor (SP).
Sun acknowledges with thanks, Tomas Kopal for discovering and reporting one of the above two issues.
2. Contributing Factors
These issues can occur on the following platforms:
$ ipmitool -H <hostname> -U <username> mc infoor the following command can be used at the CLI (logged in to the SP):
/SP -> show /SP/AgentInfo
There are no predictable symptoms to indicate these issues have been exploited to gain unauthorized access to the ELOM interface.
To work around these issues, administrators may restrict access to the Service Processor (SP) on the Sun Fire servers by either connecting to it only via serial port or by allowing access to it only from a private management network.
Additional information regarding management of the Sun Fire X2100/X2200 M2 Servers, ELOM, and ipmitool(1m) can be found in the "Embedded Lights Out Manager Administration Guide" at:
These issues are addressed in the following releases:
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
This solution has no attachment