Sun Fire X2100 M2 And X2200 M2 ELOM Unspecified Remote Arbitrary Command Execution Vulnerability

Bugtraq ID:	26250
Class:	Unknown
CVE:	CVE-2007-5717
Remote:	Yes
Local:	No
Published:	Sep 29 2007 12:00AM
Updated:	May 07 2015 05:34PM
Credit:	The vendor disclosed this issue.
Vulnerable:	Sun Sun Fire X4600 M2 0 Sun Sun Fire X2200 M2 Server 0
Not Vulnerable:

Sun Fire X2100 M2 And X2200 M2 ELOM Unspecified Remote Arbitrary Command Execution Vulnerability

Sun Fire X2100 M2 and X2200 M2 servers are prone to a vulnerability that allows remote attackers to execute arbitrary commands with superuser privileges. Successful attacks may completely compromise affected servers.

This issue affects the Embedded Lights Out Manager (ELOM) for x86 architecture; no other systems are affected.

Sun Fire X2100 M2 And X2200 M2 ELOM Unspecified Remote Arbitrary Command Execution Vulnerability

Currently we are not aware of any working exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sun Fire X2100 M2 And X2200 M2 ELOM Unspecified Remote Arbitrary Command Execution Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.


Sun Sun Fire X4600 M2 0

• Sun firmware 2.70 Sun Fire X2100 M2 from Tools & Drivers CD 1.3 (or later)
  http://www.sun.com/servers/entry/x2100/downloads.jsp

Sun Sun Fire X2200 M2 Server 0

• Sun firmware 2.70 Sun Fire X2200 M2 from Tools & Drivers CD 1.3 (or later)
  http://www.sun.com/servers/x64/x2200/downloads.jsp

Sun Fire X2100 M2 And X2200 M2 ELOM Unspecified Remote Arbitrary Command Execution Vulnerability

References:

• Sun Alert ID: 103127 Sun Fire X2100/X2200 M2 Servers ELOM Software is Vulnerable (Sun Microsystems)
  
• Sun Fire X2100 M2 Server Homepage (Sun)
  
• Sun Fire X2200 M2 Server Homepage (Sun)