Safe to update ilo2 firmware to 2.27 on DL360 G5?

[eddiegb]

Hello,

I have a couple of DL360 G5 and have applied ilo2 firmware updates when they've been released, up to last years v.2.25.

Today I hear about v.2.27 released in January which addresses some serious security vulnerabilities (CVE-2015-2106, CVE-2014-7876) including privilege escalation and arbitrary code execution.

The release notes with the 2.25 fw list the DL360 G5 under "products affected", but all the G5 models have been removed from the list in the 2.27 fw release notes, obviously due to their reaching EOL recently.

I don't see any changes in the release notes that seem to be server specific.

So I'm wondering if its safe to update? My gut feeling is it probably is, but I'm hoping someone else might have already tried updating on a G5 server, or maybe someone from HP can "unofficially" confirm its OK?

[Torsten.]

It is the same chip, so why not?

I did this recently without a problem.

[eddiegb]

Hi Torsten,

Thanks for reporting. I think it is probably safe but I guess its possible they put something in the new relerase that only works on G6 servers and higher.

When you say you did this recently, you mean you installed this particular update on a G5 server?

thanks.

[Torsten.]

Yes, the G5 and earlier are simply not tested because EOL.