OracleVM 3.2 : OpenIPMI (OVMSA-2016-0068)

This script is Copyright (C) 2016-2017 Tenable Network Security, Inc.


Synopsis :

The remote OracleVM host is missing a security update.

Description :

The remote OracleVM system is missing necessary patches to address
critical security updates :

- ipmitool: fix ipmi command retry shifts replies
(#863310)

- ipmitool: added -b, -B, -l and -T options to ipmitool
man page (#846596)

- ipmitool: fixed man page documentation for delloem
setled command (#797050)

- ipmitool: fixed wrong permissions on ipmievd.pid
(#834190)

- ipmitool: updated delloem commands (#797050)

- ipmitool: fixed exit code of 'ipmitool -o list' command
(#740780)

- ipmitool: disabled automatic bridging of SDR readings to
IPMB in verbose mode (#749796)

- ipmitool: fixed reporting of usage of various delloem
subcommands (#658762)

- added path to /sbin to lsmod and modprobe (#829705)

- ipmitool: disabled automatic bridging of SDR readings to
IPMB (#671059)

- ipmitool: fixed 'ipmitool sol' sending wrong packets due
to miscalculation of SOL payload size (#675980)

- ipmitool: fixed 'ipmitool delloem powermonitor' on
big-endian platforms (#659326)

- ipmitool: lowered severity of 'Discovered local IPMB
address XYZ', it's visible only in the most verbose
output (#674494)

- ipmitool: fixed 'delloem mac' command on big-endian
systems (#568676)

- ipmitool: fixed Kg encryption key setting broken in
previous version (#656841)

- ipmitool: fixed crash when processing non-standard
sensor readings (#550120)

- fixed OpenIPMI pkgconfig file to include -pthreads when
needed (#591646)

- fixed impi service exit codes, 'service ipmi start' now
succeeds if the service is already started (#619143)

- ipmitool: fixed crash when receiving error instead of
sensor data (#580087)

- ipmitool: properly ignore a bit in sensor event state
(#616546)

- ipmitool: fixed a memory leak on receiving SOL ack
(#616546)

- ipmitol: fixed reading of sensor state if the BMC
provides only part of it (#541263)

- ipmitool: fixed buffer overflow in tsol module (#546386)

- ipmitool: fixed checking of several command line
arguments (#514218 #514237)

- ipmitool: improved error message when wrong
user/password is supplied (#552458)

- ipmitool: fixed 'user priv' command, now it does not
enable IPMI messaging by default (#552459)

- ipmitool: added 'delloem' command for Dell-specific IPMI
extensions (#568676)

- ipmitool: added 'channel setkg' command to set Kg
encryption key (#503039)

- ipmitool: added detection of local IPMB address,
messages to BMC won't be unnecessarily tunneled
(#636854)

See also :

https://oss.oracle.com/pipermail/oraclevm-errata/2016-June/000487.html

Solution :

Update the affected OpenIPMI-tools package.

Risk factor :

High

Family: OracleVM Local Security Checks

Nessus Plugin ID: 91748 ()

Bugtraq ID:

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now