Power7 High-End Power Subsystem Firmware

04/22/2015
 

• Bugzilla 120961 A security problem was fixed in OpenSSL where the service processor would, under certain conditions, accept Diffie-Hellman client certificates without the use of a private key, allowing a user to falsely authenticate . The Common Vulnerabilities and Exposures issue number is CVE-2015-0205.
• Bugzilla 120961 A security problem was fixed in OpenSSL to prevent a denial of service when handling certain Datagram Transport Layer Security (DTLS) messages. A specially crafted DTLS message could exhaust all available memory and cause the service processor to reset. The Common Vulnerabilities and Exposures issue number is CVE-2015-0206.
• Bugzilla 120961 A security problem was fixed in OpenSSL to prevent a denial of service when handling certain Datagram Transport Layer Security (DTLS) messages. A specially crafted DTLS message could do an null pointer de-reference and cause the service processor to reset. The Common Vulnerabilities and Exposures issue number is CVE-2014-3571.
• Bugzilla 120961 A security problem was fixed in OpenSSL to fix multiple flaws in the parsing of X.509 certificates. These flaws could be used to modify an X.509 certificate to produce a certificate with a different fingerprint without invalidating its signature, and possibly bypass fingerprint-based blacklisting. The Common Vulnerabilities and Exposures issue number is CVE-2014-8275.
• Bugzilla 121148 A security vulnerability, commonly referred to as GHOST, was fixed in the service processor glibc functions getbyhostname() and getbyhostname2() that allowed remote users of the functions to cause a buffer overflow and execute arbitrary code with the permissions of the server application. There is no way to exploit this vulnerability on the service processor but it has been fixed to remove the vulnerability from the firmware. The Common Vulnerabilities and Exposures issue number is CVE-2015-0235.
• Bugzilla 123149 A security problem was fixed in OpenSSL where a remote attacker could crash the service processor with malformed Elliptic Curve private keys. The Common Vulnerabilities and Exposures issue number is CVE-2015-0209.
• Bugzilla 123149 A security problem was fixed in OpenSSL where a remote attacker could crash the service processor with a specially crafted X.509 certificate that causes an invalid pointer, out-of-bounds write, or a null pointer de-reference. The Common Vulnerabilities and Exposures issue numbers are CVE-2015-0286, CVE-2015-0287, and CVE-2015-0288.

01/07/2015
 

System firmware changes that affect all systems (SW287594):
• A security problem was fixed in OpenSSL for padding-oracle attacks known as Padding Oracle On Downgraded Legacy Encryption (POODLE). This attack allows a man-in-the-middle attacker to obtain a plain text version of the encrypted session data. The Common Vulnerabilities and Exposures issue number is CVE-2014-3566. The service processor POODLE fix is based on a selective disablement of SSLv3 using the Advanced System Management Interface (ASMI) "System Configuration/Security Configuration" menu options. The Security Configuration options of "nist_sp800_131a", "nist_compat", and "legacy" for affects the disablement SSLv3 and determines the level of protection from POODLE. The management console also requires a POODLE fix for APAR MB03867(FIX FOR CVE-2014-3566 FOR HMC V7 R7.9.0 SP1 with PTF MH01484) to eliminate all vulnerability to POODLE and allow use of option 1 "nist_sp800_131a" as shown below--
  • 1)nist_sp800_131a (SSlv3 disabled)- This highest level of security protection does not allow service processor clients to connect using SSLv3, thereby eliminating any possibility of a POODLE attack. All clients must be capable of using TLS v1.2 to make the secured connections to the service processor to use this option. This requires the management console be at a minimum level that has a poodle fix such as HMC V7 R7.9.0 SP1 with POODLE PTF MH01484 or HMC V7 R7.8.0 SP2 with POODLE PTF MH01432 when it becomes available.
  • 2)nist_compat (default mode - SSLv3 enabled for HMC)- This medium level of security protection disables SSLv3 (TLS v1.2 must be used instead) for the web browser sessions to ASMI and for the CIM clients and assures them of POODLE-free connections. But the older management consoles are allowed to use SSLv3 to connect to the service processor. This is intended to allow non-POODLE compliant HMC levels to be able to connect to the CEC servers until they can be planned and upgraded to the POODLE compliant HMC levels. Running a non-POODLE compliant HMC to a service processor in this default mode will prevent the ASMI-proxy sessions from the HMC from connecting as these proxy sessions require SSLv3 support in ASMI.
  • 3) legacy (SSLv3 enabled)- This basic level of security protection enables SSLv3 for all service processor client connection. It relies on all clients being at POODLE fix compliant levels to provide full POODLE protection using the TLS Fallback Signaling Cipher Suite Value (TLS_FALLBACK_SCSV) to prevent fallback to vulnerable SSLv3 connections. This legacy option is intended for customer sites on protected internal networks that have a large investment in older hardware that need SSLv3 to make browser and HMC connections to the service processor. The level of POODLE protection actually achieved in legacy mode is determined by the percentage of clients that are at the POODLE fix compliant levels.
• 117906 A security problem was fixed in OpenSSL for memory leaks that allowed remote attackers to cause a denial of service (out of memory on the service processor). The Common Vulnerabilities and Exposures issue numbers are CVE-2014-3513 and CVE-2014-3567.

10/15/2014
 

• SW265125 Add filtering to BPR firmware to prevent susceptibility to 350V bus noise that can cause erroneous overvoltage induced BPR power off.

6/23/2014
 

System firmware changes that affect all systems (SW264792):
• HIPER /Pervasive A security problem was fixed in the OpenSSL (Secure Socket Layer) protocol that allowed clients and servers, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between the management console and the service processor. The Common Vulnerabilities and Exposures issue number for this problem is CVE-2014-0224.
• HIPER /Pervasive A security problem was fixed in OpenSSL for a buffer overflow in the Datagram Transport Layer Security (DTLS) when handling invalid DTLS packet fragments. This could be used to execute arbitrary code on the service processor. The Common Vulnerabilities and Exposures issue number for this problem is CVE-2014-0195.
• HIPER /Pervasive Multiple security problems were fixed in the way that OpenSSL handled read and write buffers when the SSL_MODE_RELEASE_BUFFERS mode was enabled to prevent denial of service. These could cause the service processor to reset or unexpectedly drop connections to the management console when processing certain SSL commands. The Common Vulnerabilities and Exposures issue numbers for these problems are CVE-2010-5298 and CVE-2014-0198.
• HIPER /Pervasive A security problem was fixed in OpenSSL to prevent a denial of service when handling certain Datagram Transport Layer Security (DTLS) ServerHello requests. A specially crafted DTLS handshake packet could cause the service processor to reset. The Common Vulnerabilities and Exposures issue number for this problem is CVE-2014-0221.
• HIPER /Pervasive A security problem was fixed in OpenSSL to prevent a denial of service by using an exploit of a null pointer de-reference during anonymous Elliptic Curve Diffie Hellman (ECDH) key exchange. A specially crafted handshake packet could cause the service processor to reset. The Common Vulnerabilities and Exposures issue number for this problem is CVE-2014-3470.

04/25/2014
 

• SW236960 System gets stuck in Low Power Mode for certain Power Line Disturbance events. Fix to take system out of this mode when disturbance recovers.
• SW249235 Post call home SRC when system is left in Low Power Mode after failed DCA repair
• SW249253 Detect and report errors on CFAM bus at DCA to reduce length and complications of repair

12/06/2013
 

• GA Level