HP ILO 4 IPMI UPGRADE
HP ILO 4 IPMI FULL
HP ILO 4 IPMI PRO
HP ILO 4 IPMI SOFTWARE
HP ILO 4 IPMI CODE

Vulnerability reported to HP PSIRT by Airbus Cert.

This can not be patched or mitigated, except by proper network isolation.įinally, as for every service running on a corporate network, iLO event logs should be centralized and monitored to detect unauthorized connections. The hash can later be brute-forced off-line. The IPMI v2 authentication protocol is affected by a design weakness that allows an attacker to retrieve a hash of the password, provided only the username is known.

Use strong, randomly generated passwords for each server instance.Īs a reminder, HP iLO 4 also exposes the IPMI interface on port 623.

Do not expose any iLO interface to any untrusted network.

Do not connect iLO to your network if the interface is not actually used.

HP iLO is an administration tool, and as such should only be accessible from an isolated VLAN, different from the users' VLAN.

HP ILO 4 IPMI UPGRADE

RecommendationsĪdministrators running iLO interfaces on their network are strongly advised to upgrade to version 2.54 or greater (HP removed version 2.53 due to a stability issue) as soon as possible, as this vulnerability could lead to a complete server compromise.

ILO 4 is known to be embedded in HP ProLiant Gen8 and Gen9 servers.

HP ILO 4 IPMI FULL

This is not a theoretical threat, as we do have a full working exploit.

HP ILO 4 IPMI CODE

This can lead to arbitrary code execution if sensitive elements on the heap are overwritten and from there to a full compromise of both the iLO and guest (server's) operating systems. This insecure call results in a heap-based buffer overflow when processing an overlong Connection header. When handling the Connection header, the sscanf() function is called with an insecure format string: The parsing is handled in a function reading each line one by one, and trying to identify and parse the various possible HTTP headers. When a new client connects to the web server, one of its 4 threads handles the connection and starts parsing the HTTP request. Heap buffer overflow in HTTP headers processing (CVE-2017-12542)

HP ILO 4 IPMI PRO

A quick Shodan indicates that some iLO interfaces are even directly connected to the Internet.Īfter a few hours of reverse enginnering to understand the memory layout and the various embedded libraries, the webserv binary can be correctly loaded in IDA Pro and analyzed. The most interesting target to look at is the webserver, which is very often exposed to the LAN, even if HP recommends to connect the iLO administration interface to a dedicated administration network. Fortunately, the firmware is signed, but not encrypted, meaning that we can start looking for vulnerabilities without having to desolder the flash chip! It is usually distributed as a PE file containing a big binary file which is sent to the iLO. ILO firmware can be directly downloaded from HP website. Interestingly, the iLO runs even if the server is turned off, and is directly connected to the main PCI-express bus.Īll its features and its crucial position in the server hardware makes iLO a really juicy target from an attacker's point of view.

HP ILO 4 IPMI SOFTWARE

On the software side, the operating system is the proprietary RTOS GreenHills Integrity.

It has a dedicated flash chip to hold its firmware, a dedicated RAM chip and a dedicated network interface. Regarding the technical aspects, iLO 4 runs on a dedicated ARM micro-processor embedded in the server, and is totally independant from the main processor. All these interfaces represent a huge attack surface for a critical, embedded component. Such features include power management, remote system console, remote CD/DVD image mounting, as well as many monitoring indicators.Īll these features can be accessed using the IPMI protocol, but also through various interfaces such as SSH, HTTPS, SNMP, and XML / JSON APIs. It provides every feature required by a system administrator to remotely administer a server without having to reach it physically. ILO is the server management solution embedded in almost every HP server for more than 10 years. We plan to release the full details of our study in an upcoming conference, stay tuned! Introduction We thus decided to give some details so that HP iLO administrators could understand the impacts and protect their servers. Now that a security bulletin and a fixed firmware have been released by HP (4 months ago), there is a significant risk that the vulnerability has been found by people doing binary diffing between two versions of the firmware. This vulnerability has been found during a security study of HP iLO performed by Alexandre Gazet from Airbus and Fabien Perigaud.

Hp ilo 4 ipmi