Red Hat Security Advisory: OpenIPMI security, bug fix, and enhancement update Security Advisory secalert@redhat.com Red Hat Security Response Team RHSA-2013:0123 Final 1 1 2013-01-08T04:08:00Z Current version 2013-01-08T04:08:00Z 2013-01-08T04:08:00Z Red Hat rhsa-to-cvrf 1.0.1484 2013-01-08T04:51:01Z Updated OpenIPMI packages that fix one security issue, multiple bugs, and add one enhancement are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The OpenIPMI packages provide command line tools and utilities to access platform information using Intelligent Platform Management Interface (IPMI). System administrators can use OpenIPMI to manage systems and to perform system health monitoring. It was discovered that the IPMI event daemon (ipmievd) created its process ID (PID) file with world-writable permissions. A local user could use this flaw to make the ipmievd init script kill an arbitrary process when the ipmievd daemon is stopped or restarted. (CVE-2011-4339) Note: This issue did not affect the default configuration of OpenIPMI as shipped with Red Hat Enterprise Linux 5. This update also fixes the following bugs: * Prior to this update, the ipmitool utility first checked the IPMI hardware for Dell IPMI extensions and listed only supported commands when printing command usage like the option "ipmtool delloem help". On a non-Dell platform, the usage text was incomplete and misleading. This update lists all Dell OEM extensions in usage texts on all platforms, which allows users to check for command line arguments on non-Dell hardware. (BZ#658762) * Prior to this update, the ipmitool utility tried to retrieve the Sensor Data Records (SDR) from the IPMI bus instead of the Baseboard Management Controller (BMC) bus when IPMI-enabled devices reported SDR under a different owner than the BMC. As a consequence, the timeout setting for the SDR read attempt could significantly decrease the performance and no sensor data was shown. This update modifies ipmitool to read these SDR records from the BMC and shows the correct sensor data on these platforms. (BZ#671059, BZ#749796) * Prior to this update, the exit code of the "ipmitool -o list" option was not set correctly. As a consequence, "ipmitool -o list" always returned the value 1 instead of the expected value 0. This update modifies the underlying code to return the value 0 as expected. (BZ#740780) * Prior to this update, the "ipmi" service init script did not specify the full path to the "/sbin/lsmod" and "/sbin/modprobe" system utilities. As a consequence, the init script failed when it was executed if PATH did not point to /sbin, for example, when running "sudo /etc/init.d/ipmi". This update modifies the init script so that it now contains the full path to lsmod and modrpobe. Now, it can be executed with sudo. (BZ#829705) * Prior to this update, the ipmitool man page did not list the "-b", "-B", "-l" and "-T" options. In this update, these options are documented in the ipmitool man page. (BZ#846596) This update also adds the following enhancement: * Updates to the Dell-specific IPMI extension: A new vFlash command, which allows users to display information about extended SD cards; a new setled command, which allows users to display the backplane LED status; improved error descriptions; added support for new hardware; and updated documentation of the ipmitool delloem commands in the ipmitool manual page. (BZ#797050) All users of OpenIPMI are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add this enhancement. Please see https://www.redhat.com/footer/terms-of-use.html Copyright © 2013 Red Hat, Inc. All rights reserved. Low https://rhn.redhat.com/errata/RHSA-2013-0123.html https://rhn.redhat.com/errata/RHSA-2013-0123.html https://access.redhat.com/security/updates/classification/#low https://access.redhat.com/security/updates/classification/#low https://bugzilla.redhat.com/show_bug.cgi?id=658762 https://bugzilla.redhat.com/show_bug.cgi?id=658762 https://bugzilla.redhat.com/show_bug.cgi?id=671059 https://bugzilla.redhat.com/show_bug.cgi?id=671059 https://bugzilla.redhat.com/show_bug.cgi?id=740780 https://bugzilla.redhat.com/show_bug.cgi?id=740780 https://bugzilla.redhat.com/show_bug.cgi?id=749796 https://bugzilla.redhat.com/show_bug.cgi?id=749796 https://bugzilla.redhat.com/show_bug.cgi?id=829705 https://bugzilla.redhat.com/show_bug.cgi?id=829705 Red Hat Enterprise Linux Desktop (v. 5 client) RHEL Desktop Workstation (v. 5 client) Red Hat Enterprise Linux (v. 5 server) OpenIPMI-2.0.16-16.el5.src.rpm OpenIPMI-2.0.16-16.el5 as a component of Red Hat Enterprise Linux Desktop (v. 5 client) OpenIPMI-2.0.16-16.el5 as a component of RHEL Desktop Workstation (v. 5 client) OpenIPMI-2.0.16-16.el5 as a component of Red Hat Enterprise Linux (v. 5 server) It was discovered that the IPMI event daemon (ipmievd) created its process ID (PID) file with world-writable permissions. A local user could use this flaw to make the ipmievd init script kill an arbitrary process when the ipmievd daemon is stopped or restarted. 2011-10-03T00:00:00Z 2011-12-13T00:00:00Z CVE-2011-4339 5Client-Workstation:OpenIPMI-2.0.16-16.el5 5Client:OpenIPMI-2.0.16-16.el5 5Server:OpenIPMI-2.0.16-16.el5 Moderate 4.7 AV:L/AC:M/Au:N/C:N/I:N/A:C Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 https://rhn.redhat.com/errata/RHSA-2013-0123.html https://www.redhat.com/security/data/cve/CVE-2011-4339.html CVE-2011-4339 https://bugzilla.redhat.com/show_bug.cgi?id=742837 bz#742837: CVE-2011-4339 OpenIPMI: IPMI event daemon creates PID file with world writeable permissions