OA Module Compromised

[sgunelius]

Our security team discovered a Standby OA Module making NTP connection attempts to IP addresses (registered in South Africa) not defined in our configuration.  We were running v3.71 firmware which I've since upgraded to v4.01 in response to this.  I opened a support call with HP (getting more and more frustrated with them after 15 years of good service) and was told that from what they could see the OA module was functioning properly.  Even though I explained it was their hardware, firmware and software, that I had made no customizations that would've resulted in this issue, they stuck to the script.  I ended up opening a ticket online and calling our HP rep to have this kicked upstairs.  I also reported this through their website as a possible vulnerability.

Has anyone seen anything similar with the OA module and/or the 3.71 firmware?  Thanks.

Scott

[Torsten.]

Could it be another component (ILO, interconnect) is asking for this NTP server via the OA network? Check the settings.