OA Heartbleed update?

[Trygve Henriksen]

According to a post on the interwebs, OA v4.11 web interface is affected by the Heartbleed screwup.

Is there a 'known good' version that is recommended or will there be a fix up soon?

[scharchouf]

can you give us more details, because what you said is not mentioned at HP as a bug, known issue ....

[Andrew Hammond]

I found this.

http://alpacapowered.wordpress.com/2014/04/08/openssl-heartbleed-attack-the-cryptocalypitc-judgement-day-has-arrived/

Is there a Security Advisory from HP regarding affected products?

[Oscar A. Perez]

OA v4.11 and v4.20 contain an OpenSSL version that has the vulnerability.

Please go back to v4.01 until we can release a fix.

Oh, by the way.

iLOs are NOT vulnerable as they don't use SSL/TLS libraries that contain the TLS heartbeat extension BUT, we are receiving reports that the script that test for the HeartBleed bug is causing iLO2 to stop responding and the blades have to be e-fused to recover iLO2 functionality.  

Please don't run the Heartbleed script against iLO2 until we fix this problem. 

[Barmaley]

Oscar,

Is possible to deactivate some iLO functionality and features to do it invulnerable for HeartBleed?

May be change SSL port to not 443?
May be enable the "Enforce AES/3DES Encryption"?

Something else?

[RyanTerry]

Is there an ETA for a fix for this? 

We are running 4.0.1a and are seeing all of our iLO cards crash.  We cannot upgrade to the releases that are vulnerable.

[Barmaley]

+1

We have >300 servers iLO2 offline. It' horrible :(

[Oscar A. Perez]

Please do not scan iLO for heartbleed. iLOs are not vulnerable as they have never supported TLS HeartBeat extension anyway.

We are investigating why iLO2 stops responding after security scanners run the Heartbleed bug test but, so far we cannot even reproduce this issue in our labs. Any info that can help us reproduce the issue is welcomed.

[Barmaley]

Oscar,

We have one of servers which we can access remotelly.

Also, iLO address of this server responds to ping's.

But do not allow to connect via HTTP(s), IPMI or SSH.

Here is output of hponcfg utility:

# hponcfg
HP Lights-Out Online Configuration utility
Version 4.3.0 Date 12/10/2013 (c) Hewlett-Packard Company, 2014

ERROR: CpqCiCreateFunc() 0 time failed.
Driver Error Code:(1,1h).
Driver Error Message: CPQCIDRV driver is not loaded.

ERROR: CpqCiCreateFunc() 1 time failed.
Driver Error Code:(1,1h).
Driver Error Message: CPQCIDRV driver is not loaded.
ERROR: A general system error occurred while detecting Management Processor.
ACTION REQUIRED: Check if iLO and iLO driver are up and running.

[scharchouf]

HP is currently investigating the issue and which systems are potentially affected.  and when all investigation is done a formal noticed will be published.

[RyanTerry]

I was able to get the iLO addresses excluded from any futre scans.  However all of my iLO 2 cards are down. 

Bay iLO Name                      iLO IP Address  Status   Power   UID Partner
--- ----------------------------- --------------- -------- ------- --- -------
  1 [Unknown]                     N/A             Failed   On       ?
  2 [Unknown]                     N/A             Failed   On       ?

Is there a way to reset iLO in this state without a reboot of the server?

[RyanTerry]

Oscar,

We are running a c7000 enclosure with the 4.01 Firmware for OA.  The scanner that was used to test is from Qualsys.  We have confirmed that after a reset, the scan still crashes the iLO2 card.

[tjagoda]

We are seeing this behavior on all iLO2 blades, observed firmware ranging from 2.12 through 2.23.  A way to reset the management processor without requiring the physical re-seating of the blade would be spectacular, so far hponcfg, ssh, and the web interface have been unresponsive. 

[Daniel McPeake]

Our secruity group scanned for the hearbleed bug last night and crashed about 500 ilo2. Is there anyway to recover without powering off all these servers?

[RyanTerry]

tjagoda,

we were able to use:

reset server [bay number]

ssh'd into the OA card.  However it still reboots the server.  Still looking to see if there is a way to recover without a reboot.

[tjagoda]

That is at least better than requiring a physical re-seating, but ideally we would still like a way to reset the management processor without a downtime-generating event.  

[Wohlstand]

I can confirm this behavior. I had to take our  server from power by a support man on remote site. Really no fun. And a real DOS. There will be some script kiddies who will break down our ILO2 interface in the next hours. I can bet for it.

[lindnear]

Hi Folks,

is iLO4 allso affected by this bug? We have a lot of iLO4 Boards in use and I'm asking if a scan would down all iLO Boards.

Thx for your replys,

Alex

[Luke Hsieh]

Per following link, HP has verified that it's only ILO1 and ILO2 that are affected.  We have not seen similar issues in our ILO3/4 as well.

http://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c04249852

Edit: fixed link :p

[AlexanderGom]

If you are a HP employee, we have this sharepoint with a good information about the Heartbleed Vulnerability

http://h30499.www3.hp.com/t5/HP-BladeSystem-Management/OA-Heartbleed-update/m-p/6444874/highlight/true#.U1fdarEo4b_

[Dennis Handly]

>we have this sharepoint

Your link just points to this topic.

You can edit your post by using Post Options > Edit Reply.

[Torsten.]

By the way - OA firmware 4.21 is available!

http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetails/?sp4ts.oid=5193138&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3Didx%253D%257CswItem%253DMTX_05517b539ee741daae3aaa08f3%257CswEnvOID%253D4103%257CitemLocale%253D%257CswLang%253D%257Cmode%253D%257Caction%253DdriverDocument&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vig...

Disabled support for OpenSSL TLS heartbeat extension.

http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetails/?sp4ts.oid=5193138&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3Didx%253D3%257CswItem%253DMTX_05517b539ee741daae3aaa08f3%257CswEnvOID%253D4103%257CitemLocale%253D%257CswLang%253D%257Cmode%253D4%257Caction%253DdriverDocument&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.v...

[Luke Hsieh]

ILO2 firmware v2.25 is available now.  

http://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetails/?sp4ts.oid=3884320&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3Didx%253D%257CswItem%253DMTX_aad4359580924edf83d37a0517%257CswEnvOID%253D4064%257CitemLocale%253D%257CswLang%253D%257Cmode%253D%257Caction%253DdriverDocument&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vig...

[Enzo Genuardi]

Hello,

The ILO2 FW version 2.25 was issued and also the OA FW version 4.21, who at least is preventing the hack.

But, for all other ILO2 who where blocked by the first scan, did someone as a solution to force then to reset without rebooting the server?

Best regards.

[Enzo Genuardi]

Hello Alex,

As far as I have seen on my servers ILO3 FW 1.70 and ILO4 with 1.32 or 1.40 are not concerned!
Regards.