HPE BladeSystem Management Software
Showing results for 
Search instead for 
Do you mean 

OA Heartbleed update?

Respected Contributor

OA Heartbleed update?

According to a post on the interwebs, OA v4.11 web interface is affected by the Heartbleed screwup.

 

Is there a 'known good' version that is recommended or will there be a fix up soon?

 

 

24 REPLIES
HPE Pro

Re: OA Heartbleed update?

can you give us more details, because what you said is not mentioned at HP as a bug, known issue ....
I work for HP
A quick resolution to technical issues for your HP Enterprise products is just a click away HP Support Center Knowledge-base
See Self Help Post for more details

Occasional Collector

Re: OA Heartbleed update?

I found this.

 

http://alpacapowered.wordpress.com/2014/04/08/openssl-heartbleed-attack-the-cryptocalypitc-judgement-day-has-arrived/

 

Is there a Security Advisory from HP regarding affected products?

 

 

Honored Contributor Honored Contributor

Re: OA Heartbleed update?

OA v4.11 and v4.20 contain an OpenSSL version that has the vulnerability.

 

Please go back to v4.01 until we can release a fix.

 

Oh, by the way.

iLOs are NOT vulnerable as they don't use SSL/TLS libraries that contain the TLS heartbeat extension BUT, we are receiving reports that the script that test for the HeartBleed bug is causing iLO2 to stop responding and the blades have to be e-fused to recover iLO2 functionality.  

Please don't run the Heartbleed script against iLO2 until we fix this problem. 




__________________________________________________
I work for Hewlett Packard

If you feel this was helpful please click the KUDOS! thumb below!
Occasional Advisor

Re: OA Heartbleed update?

Oscar,

 

Is possible to deactivate some iLO functionality and features to do it invulnerable for HeartBleed?

 

May be change SSL port to not 443?
May be enable the "Enforce AES/3DES Encryption"?

 

Something else?

Occasional Advisor

Re: OA Heartbleed update?

Is there an ETA for a fix for this? 

 

We are running 4.0.1a and are seeing all of our iLO cards crash.  We cannot upgrade to the releases that are vulnerable.

Occasional Advisor

Re: OA Heartbleed update?

+1

 

We have >300 servers iLO2 offline. It' horrible :(

Honored Contributor Honored Contributor

Re: OA Heartbleed update?

Please do not scan iLO for heartbleed. iLOs are not vulnerable as they have never supported TLS HeartBeat extension anyway.

We are investigating why iLO2 stops responding after security scanners run the Heartbleed bug test but, so far we cannot even reproduce this issue in our labs. Any info that can help us reproduce the issue is welcomed.




__________________________________________________
I work for Hewlett Packard

If you feel this was helpful please click the KUDOS! thumb below!
Occasional Advisor

Re: OA Heartbleed update?

Oscar,

 

We have one of servers which we can access remotelly.

Also, iLO address of this server responds to ping's.

But do not allow to connect via HTTP(s), IPMI or SSH.

 

Here is output of hponcfg utility:

 

# hponcfg
HP Lights-Out Online Configuration utility
Version 4.3.0 Date 12/10/2013 (c) Hewlett-Packard Company, 2014

ERROR: CpqCiCreateFunc() 0 time failed.
Driver Error Code:(1,1h).
Driver Error Message: CPQCIDRV driver is not loaded.

ERROR: CpqCiCreateFunc() 1 time failed.
Driver Error Code:(1,1h).
Driver Error Message: CPQCIDRV driver is not loaded.
ERROR: A general system error occurred while detecting Management Processor.
ACTION REQUIRED: Check if iLO and iLO driver are up and running.

HPE Pro

Re: OA Heartbleed update?

HP is currently investigating the issue and which systems are potentially affected.  and when all investigation is done a formal noticed will be published.

I work for HP
A quick resolution to technical issues for your HP Enterprise products is just a click away HP Support Center Knowledge-base
See Self Help Post for more details

Occasional Advisor

Re: OA Heartbleed update?

I was able to get the iLO addresses excluded from any futre scans.  However all of my iLO 2 cards are down. 

 

Bay iLO Name                      iLO IP Address  Status   Power   UID Partner
--- ----------------------------- --------------- -------- ------- --- -------
  1 [Unknown]                     N/A             Failed   On       ?
  2 [Unknown]                     N/A             Failed   On       ?

 

Is there a way to reset iLO in this state without a reboot of the server?

Occasional Advisor

Re: OA Heartbleed update?

Oscar,

 

We are running a c7000 enclosure with the 4.01 Firmware for OA.  The scanner that was used to test is from Qualsys.  We have confirmed that after a reset, the scan still crashes the iLO2 card.

Highlighted
Occasional Visitor

Re: OA Heartbleed update?

We are seeing this behavior on all iLO2 blades, observed firmware ranging from 2.12 through 2.23.  A way to reset the management processor without requiring the physical re-seating of the blade would be spectacular, so far hponcfg, ssh, and the web interface have been unresponsive. 

Occasional Visitor

Re: OA Heartbleed update?

[ Edited ]

Our secruity group scanned for the hearbleed bug last night and crashed about 500 ilo2. Is there anyway to recover without powering off all these servers?

Occasional Advisor

Re: OA Heartbleed update?

tjagoda,

 

we were able to use:

 

reset server [bay number]

 

ssh'd into the OA card.  However it still reboots the server.  Still looking to see if there is a way to recover without a reboot.

Occasional Visitor

Re: OA Heartbleed update?

That is at least better than requiring a physical re-seating, but ideally we would still like a way to reset the management processor without a downtime-generating event.  

 

Occasional Visitor

ILO 2 crashes

I can confirm this behavior. I had to take our  server from power by a support man on remote site. Really no fun. And a real DOS. There will be some script kiddies who will break down our ILO2 interface in the next hours. I can bet for it.

Occasional Visitor

Re: OA Heartbleed update?

Hi Folks,

 

is iLO4 allso affected by this bug? We have a lot of iLO4 Boards in use and I'm asking if a scan would down all iLO Boards.

 

Thx for your replys,

 

Alex

Occasional Advisor

Re: OA Heartbleed update?

[ Edited ]

Per following link, HP has verified that it's only ILO1 and ILO2 that are affected.  We have not seen similar issues in our ILO3/4 as well.

http://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04249852

Edit: fixed link :p

Occasional Visitor

Re: OA Heartbleed update?

If you are a HP employee, we have this sharepoint with a good information about the Heartbleed Vulnerability

 

http://h30499.www3.hp.com/t5/HP-BladeSystem-Management/OA-Heartbleed-update/m-p/6444874/highlight/true#.U1fdarEo4b_

Acclaimed Contributor Acclaimed Contributor

Re: OA Heartbleed update?

[ Edited ]

>we have this sharepoint

 

Your link just points to this topic.

You can edit your post by using Post Options > Edit Reply.

Acclaimed Contributor Acclaimed Contributor

Re: OA Heartbleed update - OA fw 4.21!

[ Edited ]

Re: OA Heartbleed update?

Hello,

 

The ILO2 FW version 2.25 was issued and also the OA FW version 4.21, who at least is preventing the hack.

But, for all other ILO2 who where blocked by the first scan, did someone as a solution to force then to reset without rebooting the server?

 

Best regards.

Re: OA Heartbleed update?

Hello Alex,

As far as I have seen on my servers ILO3 FW 1.70 and ILO4 with 1.32 or 1.40 are not concerned!
Regards.