PSA: Supermicro X11 BMC firmware version 1.66 has multiple
vulnerabilities, update to 1.68 (?)
reddit / selfhosted

----------------------------------------------------------------------
TrenchcoatTechnocrat · 2023-10-05 20:19

This has been reported elsewhere (see [Supermicro's announcement](http
s://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023)).

I'm writing this post mainly because I had trouble figuring out which
software versions were actually affected. The CVE pages aren't
populated as of writing.

I found in [the original write-up by Binarly](https://binarly.io/posts
/Binarly_REsearch_Uncovers_Major_Vulnerabilities_in_Supermicro_BMCs/)
who discovered the vulnerabilities, they describe testing against BMC
firmware version 1.66. Presumably that's the only version known to be
affected.

As of writing, [the latest BMC firmware version for the X11 boards is
1.68](https://www.supermicro.com/en/support/resources/downloadcenter/f
irmware/MBD-X11SAE-F/BMC). Supermicro doesn't publish release notes
for anything, so there's no confirmation by Supermicro or Binarly that
1.68 patches these vulnerabilities. I note that the 1.68 firmware is
dated August 10, and [the CVE records were created August
14](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40284).
This timeline is consistent with Supermicro patching the
vulnerabilities before they were disclosed to the public.

Of course the BMC firmware page still *warns against updating
firmware*, saying

> Please do not download / upgrade the Firmware UNLESS your system has
a firmware-related issue. Flashing the wrong firmware can cause
irreparable damage to the system.

I note that I did click the "receive update notifications" box on the
BMC firmware page, but I didn't receive any notification about this
update. I only knew about the update because I set up visualping to
monitor the page.

If anyone from Supermicro is reading this: your company is grossly
negligent about security. I understand you've made a lifestyle out of
not caring, but I humbly suggest you will care if your company gets
fined and your job goes kerpoof. Supply chain security is getting more
attention now, and Supermicro's turn in the hot seat is a matter of
"when", not "if".

----------------------------------------------------------------------
Fluffer_Wuffer · 2023-10-06 08:21

This a problem with all old servers, I dread to think how many people
are running antique version of iDRAC with there 12-15 year old Rx10
PowerEdge servers, or HP ILO.

One solution is, keep OOBM is a non-routable VLAN.

----------------------------------------------------------------------
kmisterk · 2023-10-06 17:28

## Post Removed

Hey, TrenchcoatTechnocrat!

Thanks for your submission on selfhosted.

Your post has been removed due to a violation of the purpose of the
subreddit: **Self Hosting**

## Not Self-Hosted

When it comes to posts regarding applications in this subreddit, they
must feature a self-hosted tool, or a tool that *can be* self-hosted,
or some kind of related information, help request, or otherwise
related to a tool that is something that one can self-host.

If you believe this post *is in fact* relevant to /r/selfhosted, feel
free to [message the mods](https://www.reddit.com/message/compose/?to=
/r/selfhosted&subject=Removed For Not Being Self-
Hosted&message=[Removed
Post](https://www.reddit.com/r/selfhosted/comments/170s6od/-/\)) with
your concerns.