VxRail: IPMI v2.0 Password Hash Disclosure
Summary: The vulnerability scanner reports that the remote host supports Intelligent Platform Management Interface (IPMI) version 2.0.
This article applies to
This article does not apply to
This article is not tied to any specific product.
Not all product versions are identified in this article.
Symptoms
The vulnerability scanner reports that the remote host supports IPMI version 2.0.
The IPMI protocol is affected by an information disclosure vulnerability due to the support of RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication. A remote attacker can obtain password hash information for valid user accounts using the HMAC from a RAKP message 2 response from a BMC.
Cause
This is an inherent problem with the specification for IPMI v2.0.
Resolution
There is no patch for this vulnerability.
- Dell Technologies recommends disabling IPMI-over-LAN, which can be done using iDRAC web interface or RACADM command.
For the iDRAC web interface, login and navigate to:
System > iDRAC Settings > Network/Security > Network > IPMI Settings
Clear Enable IPMI Over LAN.
Or
For RACADM, run the following command:
If IPMI-over-LAN is required, follow best practices as below:
System > iDRAC Settings > Network/Security > Network > IPMI Settings
Clear Enable IPMI Over LAN.
Or
For RACADM, run the following command:
racadm r <IP_Address> -u root p <password> -I config g cfgIpmiLan o cfgIpmiLanEnable 0If IPMI-over-LAN is required, follow best practices as below:
- Use strong passwords to limit the successfulness of offline dictionary attacks.
- Use Access Control Lists (ACLs)
- Use isolated networks to limit access to your IPMI management interfaces.
Additional Information
RACADM management is still possible with IPMI-over-LAN disabled and is not affected by this issue.
Affected Products
VxRail, VxRail 460 and 470 Nodes, VxRail Appliance Series, VxRail D Series Nodes, VxRail D560, VxRail D560F, VxRail E Series Nodes, VxRail E460, VxRail E560, VxRail E560FProducts
VxRail G Series Nodes, VxRail E560N, VxRail E660, VxRail E660F, VxRail E660N, VxRail E665, VxRail E665F, VxRail E665N, VxRail G560, VxRail G560F, VxRail P Series Nodes, VxRail P470, VxRail P570, VxRail P570F, VxRail P580N, VxRail P670F, VxRail P670N
, VxRail P675F, VxRail P675N, VxRail S Series Nodes, VxRail S470, VxRail S570, VxRail S670, VxRail V Series Nodes, VxRail V470, VxRail V570, VxRail V570F, VXRAIL V670F, VxRail VD-4510C, VxRail VD-4520C, VxRail VD Series Nodes, VxRail VE-660, VxRail VE-6615, VxRail VP-760, VxRail VP-7625, VxRail VS-760
...
Article Properties
Article Number: 000041520
Article Type: Solution
Last Modified: 30 Mar 2025
Version: 4
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.