Intel® Management Engine Vulnerability

[Yon90]

Hi HP,

Kindly assist to check if the following servers need to update the firmware.

HP Prolaint DL380 G7
HP Proliant BL460C
HP Proliant DL320 G3
HP Proliant DL320 G5
HP Proliant DL320 G6
HP Proliant DL360 G6
HP Proliant DL360 G9
HP Proliant DL380
HP Proliant DL380 G3
HP Proliant DL380 G4
HP Proliant DL380 G5
HP Proliant DL380 G6
HP Proliant DL380 G7
HP Proliant DL580 G4
HP Proliant DL580 G7


https://www.intel.com/content/www/us/en/support/articles/000025619/software.html
They are not in the affected list.
We did scan on our servers, there is no ME installed.  Please refer to image below.

[Torsten. · Accepted solution]

The issue affects some Gen9 and Gen10 models only, see

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00036596en_us

[J Magun]

It would be nice to see a matrix of what is affected and links to protection. Many HPE customers have models ranging from Gen 6-Gen 10.

The link here does not show Which models are affected in a clear message. The note at the bottom of the article seems to say it affects alot more models... but not sure it just is referencing what you can get alerts on. It is just not clear.

I put in a call to HPE last week and still do not have an answer.

[Torsten.]

At the bottom of the page:

Hardware Platforms Affected: HPE ProLiant ML30 Gen9 Server, HPE ProLiant DL20 Gen9 Server, HPE ProLiant m710x Server Cartridge, HPE ProLiant MicroServer Gen10, HPE ProLiant DL360 Gen10 Server, HPE ProLiant BL460c Gen10 Server Blade, HPE ProLiant DL380 Gen10 Server, HPE ProLiant DL560 Gen10 Server, HPE ProLiant XL230k Gen10 Server, HPE ProLiant XL170r Gen10 Server, HPE ProLiant XL190r Gen10 Server, HPE Apollo 2000 System, HPE ProLiant DL580 Gen10 Server, HPE ProLiant ML110 Gen10 Server, HPE ProLiant ML350 Gen10 Server, HPE Apollo 4510 System, HPE ProLiant XL450 Gen10 Server, HPE Apollo 6000 DLC System, HPE ConvergedSystem 500 for SAP HANA Scale-out Configurations, HPE ConvergedSystem 500 for SAP HANA Scale-up Configurations

Operating Systems Affected: Not Applicable

Software Affected: Not Applicable

Support Communication Cross Reference ID: SIK2708