PT-2014-3898 · Ibm · Ibm Bladecenter Advanced Management Module+1

Published 2014-07-07 · Updated 2017-08-29 · CVE-2014-0860

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM BladeCenter Advanced Management Module (AMM) versions prior to 3.66E IBM Integrated Management Module (IMM) versions prior to 1.43 IBM Integrated Management Module II (IMM2) versions prior to 4.15

Description The issue allows attackers to execute arbitrary IPMI commands and establish a blade remote-control session by leveraging access to the chassis internal network or the Ethernet-over-USB interface. This is possible due to cleartext IPMI credentials in the firmware.

Recommendations For IBM BladeCenter Advanced Management Module (AMM) versions prior to 3.66E, update to version 3.66E or later. For IBM Integrated Management Module (IMM) versions prior to 1.43, update to version 1.43 or later. For IBM Integrated Management Module II (IMM2) versions prior to 4.15, update to version 4.15 or later.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2014-0860

Affected Products

Ibm Bladecenter Advanced Management Module

Integrated Management Module Ii

References · 3

• http://ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0860 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/90880 · Note