USBAnywhere Bugs in Supermicro Servers Allow Remote USB Access

guest · Sep 3, 2019

USBAnywhere Bugs in Supermicro Servers Allow Remote USB Access
September 3, 2019
https://www.bleepingcomputer.com/ne...n-supermicro-servers-allow-remote-usb-access/

Baseboard management controllers (BMC) of some Supermicro servers are vulnerable to unauthorized virtual USB mounting attacks that can be carried out remotely.
Insecure connection and authentication
Several issues have been discovered in the virtual media implementation of the BMC component in Supermicro X9, X10, and X11 platforms. Collectively, the bugs are named USBAnywhere.

These micro components also allow mounting a disk image as a virtual USB drive. Researchers at firmware hardware security firm Eclypsium found that on some Supermicro platforms the virtual media service responsible for this action is insecure over a remote connection.

"When accessed remotely, the virtual media service allows plaintext authentication, sends most traffic unencrypted, uses a weak encryption algorithm for the rest, and is susceptible to an authentication bypass" - Eclypsium
In a research paper today, Eclypsium details the vulnerabilities and how they can be exploited by a threat actor.
Click to expand...

Eclypsium: Virtual Media Vulnerability in BMC Opens Servers to Remote Attack

guest · Sep 5, 2019

Supermicro fixes BMC software flaws that expose servers to virtual USB attacks
September 5, 2019
https://www.scmagazine.com/home/net...s-that-expose-servers-to-virtual-usb-attacks/

High-tech manufacturer Supermicro this week issued an update for its baseboard management controller (BMCs) software, after researchers found a series of vulnerabilities that remote attackers could exploit to mount USB devices to affected servers over any network connection, including the internet.

After downloading the software updates, users can further mitigate the problems by operating BMCs on an isolated private network (and not the internet), and disabling Virtual Media by blocking TCP port 623, Supermicro recommends its own online vulnerability advisory.
At the time Eclypsium published its blog post, its researchers were aware of at least 47,000 systems with their BMCs exposed to the internet and using the affected protocol.
Click to expand...

Log in or Sign up

USBAnywhere Bugs in Supermicro Servers Allow Remote USB Access

guest Guest

guest Guest

Log in or Sign up

USBAnywhere Bugs in Supermicro Servers Allow Remote USB Access

guest Guest

guest Guest

Useful Searches