Bug 1326638 (CVE-2013-4786)

Summary:	CVE-2013-4786 OpenIPMI, freeipmi: Leakage of password hashes via RAKP authentication
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aledvink, branto, mdshaikh, pknirsch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-04-14 09:58:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1326639, 1326640
Bug Blocks:	1326641

Description Adam Mariš 2016-04-13 09:24:12 UTC

It was found that RAKP protocol as used in IPMI 2.0 specification allows remote attackers to obtain HMAC IPMI password hash that can be cracked offline.

External References:

http://fish2.com/ipmi/remote-pw-cracking.html
https://community.rapid7.com/community/metasploit/blog/2013/07/02/a-penetration-testers-guide-to-ipmi

Comment 1 Adam Mariš 2016-04-13 09:24:36 UTC

Created OpenIPMI tracking bugs for this issue:

Affects: fedora-all [bug 1326639]

Comment 2 Adam Mariš 2016-04-13 09:24:42 UTC

Created freeipmi tracking bugs for this issue:

Affects: fedora-all [bug 1326640]

Comment 3 Boris Ranto 2016-04-13 19:54:44 UTC

I'm not sure what are we supposed to do here? This is an issue in hardware. It is (the firmware in the) BMC controller that sends the RAKP 2 message. We do not send the message in any of the specified software. We just receive it.

Also, the BMC firmware just follows the (faulty) specification and its firmware would have to be updated alongside the IPMI specs to fix this issue.

-> I'm inclined to close these bugs as CANTFIX or NOTABUG

Comment 4 Stefan Cornelius 2016-04-14 09:58:38 UTC

Statement:

This issue did not affect the versions of OpenIPMI or freeipmi as shipped with Red Hat Enterprise Linux 5, 6, and 7.