Description
Apple Xserve Lights-Out Management before Firmware Update 1.0 on Intel hardware does not require a password for remote access to IPMI, which allows remote attackers to gain administrative access via unspecified requests with ipmitool.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://lists.apple.com/archives/security-announce/2007/May/msg00006.html ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34651 ↗
- http://osvdb.org/36128 ↗
- http://www.securitytracker.com/id?1018181 ↗
- http://www.securityfocus.com/bid/24257 ↗
- http://www.vupen.com/english/advisories/2007/2014 ↗
- http://secunia.com/advisories/25499 ↗
- http://docs.info.apple.com/article.html?artnum=305571 ↗
- http://www.apple.com/support/downloads/xservelightsoutmanagementfirmwareupdate10.html ↗