Firmware Vulnerabilities Disclosed in Supermicro Server Products

guest · Jun 8, 2018

Firmware Vulnerabilities Disclosed in Supermicro Server Products
June 7, 2018
https://www.bleepingcomputer.com/ne...ties-disclosed-in-supermicro-server-products/

Security researchers have uncovered vulnerabilities affecting the firmware of Supermicro server products.

Discovered by the Eclypsium team, these vulnerabilities affect both older and newer models of Supermicro products, but the vendor is working on addressing the issues.
Malware can modify Descriptor Region settings
The first of the flaws uncovered by Eclypsium researchers is not an actual vulnerability in the firmware's code, but in the configuration of some Supermicro products.

According to Eclypsium researchers, some Supermicro products had an incorrectly set Descriptor Region that allowed software running on the OS (such as malware) to modify the Descriptor Region and then tamper with local firmware.
Supermicro working on fixes
Eclypsium says it notified Supermicro about all the issues they discovered in the firmware of their products back in January.
Click to expand...

guest · Sep 7, 2018

Vulnerabilities found in the remote management interface of Supermicro servers
Eclypsium researchers disclose second vulnerability affecting Supermicro servers in the past three months
September 6, 2018
https://www.zdnet.com/article/vulne...e-management-interface-of-supermicro-servers/

The firmware responsible for the remote management features of Supermicro servers contains vulnerabilities that allow attackers to gain a permanent foothold on servers even after OS reinstalls, and open closed systems to remote attacks.

According to a report authored by Eclypsium researchers and shared with ZDNet prior to publication, the vulnerabilities affect the firmware of baseboard management controllers (BMCs).

"We found that the BMC code responsible for processing and applying firmware updates does not perform cryptographic signature verification on the provided firmware image before accepting the update and committing it to non-volatile storage." Eclypsium researchers said.

The full Eclypsium report containing more in-depth technical details about the flaws researchers found is scheduled to go live later today on the Eclypsium blog.
Click to expand...

Log in or Sign up

Firmware Vulnerabilities Disclosed in Supermicro Server Products

guest Guest

guest Guest

Log in or Sign up

Firmware Vulnerabilities Disclosed in Supermicro Server Products

guest Guest

guest Guest

Useful Searches