InfoSecBulletin Cybersecurity for mankind
Thousands of data centers are in danger because of a 22-year-old problem in Baseboard Management Controller (BMC) processors, says the security company Lava. BMCs are found in many server platforms. They allow server management even if the operating system is not working. They are usually very important control points in a data center.
Administrators can use a BMC to restart the host, update firmware, change basic platform settings, check hardware sensors, and more. They can do this through different management methods, such as the IPMI protocol, the Redfish API, and a web admin interface.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“In many implementations, these interfaces share the same user database. A credential that works for IPMI may also work for the web interface or Redfish API. This matters because the IPMI authentication process can expose information that enables offline password recovery,” Lava notes.
Nearly 37,000 server-management interfaces are exposed on the internet and use the IPMI protocol, according to the cybersecurity company. More than 24,000 of these show password-based authentication hashes before login.
The core issue is CVE-2013-4786, a vulnerability introduced in 2004 in the IPMI 2.0 authentication protocol that allows attackers to obtain password hashes and crack them offline by “obtaining the HMAC from a RAKP message 2 response from a BMC,” a NIST advisory reads.
“During authentication, the BMC can return an HMAC-SHA1 authentication code calculated using the account password and session values known to the requester. An unauthenticated remote party that can reach UDP port 623 can request this response and test password guesses offline,” Lava explains.
Attackers could use the security flaw to find weak, reused, or default passwords without needing to send a new request for each password. This is easier than making many login attempts online.
Lava found that 6,240 hosts let users sign in with no username and a weak password. Also, 2,340 of these had accounts like Admin or root that used passwords from well-known lists.
Some BMCs were using usual passwords and simple factory-set password types, as said by the cybersecurity company.
“This vulnerability exposes a broader security gap in the data center management plane. BMCs control critical infrastructure, yet they often receive far less monitoring and protection than the systems they manage. Combined with modern GPU cracking and predictable factory passwords, this vulnerability can turn a single exposed BMC into a privileged and difficult-to-detect foothold across the management network,” Lava notes.
