bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Security hole in HP server when powered down

Summary

In 2005 HP recommended an unusual workaround for the ProLiant DL585 server: pull the power cable. A bug in the Integrated Lights-Out remote management module up to firmware 1.8 allowed unauthorised network access to the server controls while it was switched off. Only without power was the iLO switched off as well, but then every restart required a trip to the server room.

Ideas

  • Remote management modules remain active even when the server is switched off.
  • A bug in the management controller opens access independently of the operating system.
  • Only disconnecting the power reliably switched off the vulnerable controller.
  • The workaround made remote management, the actual purpose of iLO, impossible.

Insights

  • Out-of-band management is a computer of its own with its own attack surface.
  • With servers, “switched off” does not mean “unreachable”.

Facts

  • iLO up to and including firmware 1.8 was affected; version 1.81 was in the works.
  • The problem concerned the HP ProLiant DL585 model.

References

Critique

  • The report does not say whether the attack was possible from the internet or only from the management network.

Remarks

  • Later BMC and iLO generations also had serious holes; today management controllers belong in a separate network as a matter of principle.

Recommendations

  • Operate iLO, iDRAC and other BMCs exclusively in an isolated management network.
  • Keep the firmware of management controllers as up to date as the operating system.

Read the original article

Search the Web Archive

hß · 2012

hß Security update check shut down because of a security hole

In August 2012 heise Security shut down its online update check because it required Java, and Java 7 had just been found to have a highly critical hole that was already being exploited. The hole affected all browsers with the Java 7 plugin; modules for the Blackhole exploit kit were already circulating, and no patch from Oracle had been announced yet. As an alternative, heise recommended the locally installed Personal Software Inspector.

hß · 2003

Critical security hole in the wu-ftpd server

In 2003 Janusz Niewiadomski published a buffer overflow in the FTP server wu-ftpd, versions 2.5.0 to 2.6.2, on Bugtraq. The function fb_realpath() mishandled paths longer than 4096 bytes; anyone with write access who was allowed to create directories could exploit it. The major distributions delivered updates; as a workaround, prohibiting new directories with “upload … nodirs” helped.

hß · 2025

Google Chrome: critical security hole in web browser

In August 2025 Google closed a critical hole in Chrome (CVE-2025-9478), a use-after-free bug in the WebGL backend ANGLE. Attackers could exploit the memory bug via prepared websites, which usually leads to the execution of malicious code. The hole was fixed in Chrome 139.0.7258.154/155; Chromium-based browsers such as Edge are likely to be affected as well.