Latest T4 IPMI firmware (4300207)

This article will only contain the differences of the IPMI's fixes and vulnerabilities.

3.38

1. Add feature of enable/disable services, i.e. http, http over SSL, WSMan, KVM, VM, and SSH.
   This interface is available on web or by command line.
   Command Format:
   

   0x30 0x70 0x67 [Data1] [Data2] [Data3] [Data4]
    Data1: Get(0)/Set(1)
    Data 2: Port/Service
    0: HTTP_PORT
    1: HTTPS_PORT
    2: IKVM_PORT
    3:VM_PORT
    4:SSH_PORT
    5:WSMAN_PORT
    6:HTTP_SERVICE
    7:HTTPS_SERVICE
    8:IKVM_SERVICE
    9:VM_SERVICE
    10:SSH_SERVICE
    11:WSMAN_SERVICE
    Data 3-4 : [Set]
    Data 3: port number (LSB)
    Data 4: port number (MSB)
    Return:
    [Get]
    Data1: completion code
    Data2: port number (LSB)
    Data3: port number (MSB)
    [Set]
    Data1: completion code 

2. On User page, when adding/modifying user, the password field allows special character.
3. Fix the bug the I.E browser is unable to show bbp information properly.
4. Fix the bug that, on SMTP web page, port number is not being displayed properly after refresh action is performed.
5. Add KVM reset command, raw 0x30 0x68 0x7 0x1
6. For SSL, disable the SSLv3.
7. SMTP service] Fix the bug that receiver email got extra equal sign at the front.
8. On website update page, fix the backward display of progress bar.
9. Fix the commands for those ""Restore To Default""
10. Improve connection of KVM.
11. On SMTP web page, fix the issue that error pop up message randomly display forever.
12. Correct the display information on the use of Cipher 0.
13. Active Directory] On AD setup, allow space entered in AD Group Name.
14. On firmware upgrading web page, fix the display of progress bar.
15. On web page of upgrade firmware, add the display of progress bar to indicate the progress.
16. Add SDR replacement option.
17. [Network Time Protocol] Disable status queries and restrict informational access.
18. Add the time stamp to iKVM and library jar file.
19. Fix the issue that Java iKVM Viewer is hang when open file dialog is performed in virtual storage on Mac OS
20. Add support of K80 GPU
21. Change the feature that network setting is always preserved when fw update.
22. Fix the issue that iKVM connection is drop while doing installation of OS whose file size is more than 3GB or above.
23. [WS-MAN] Fix the issue that user/password is not working correctly.
24. Improve function of OEM command of 0x30 0x90 to fix the SuperDoctor getting the wrong value.
25. Set BBP timeout shutdown feature default disabled.
26. [SSL Certification] Add the SSL key & CERT mismatch detection while deploying new certification.
27. [Security] Improve the security protection on storage of root user account.
28. Fix the Network Privilege settings.
29. Improve KVM on MAC is intimately unable to launch after several retry of close/open on Mac OS.
30. [BBP Feature]
    1. Fix the display of BBP is on the web page correctly.
    2. Correct the wording of Auto Discharge Timer.
    3. Fix the issue that Timeout Enable/Disable is not properly saved after BMC reset.
31. Add virtual media oem commands.
32. On login page, increase max allowable length of password field to 64.
33. Fix duplicated serial number 01 in SSL cert.
34. Add a feature that can log AC Power On event.
35. Prevent security key being exposed while using save/restore IPMI configuration file on the web.
36. Fix the issues that values on BBP page are not able to save.
37. Fix the failure of login while using AD server that is configured to have longer length of user domain.
38. Fix Self-Signed Certificate works, and signed Certificate by CA.
39. Description: IPMI BMCs being abused for NTP amplification DDoS attacks NTP respond to all queries, so an attacker can potentially DDOS the IPMI by sending queries

3.31

1. Change the feature that network setting is always preserved when fw update
2. Fix the issue that iKVM connection is drop while doing installation of OS whose file size is more than 3GB or above.
3. [WS-MAN] Fix the issue that user/password is not working correctly.
4. [SSL Certification] Add the SSL key & CERT mismatch detection while deploying new certification.
5. [Security] Improve the security protection on storage of root user account.
6. Fix the Network Privilege settings.
7. Improve KVM on MAC is intimately unable to launch after several retry of close/open on Mac OS.
8. On login page, increase max allowable length of password field to 64
9. Add a feature that can log AC Power On event.
10. Prevent security key being exposed while using save/restore IPMI configuration file on the web.
11. Setting of Daylight Saving Time can be adjusted while using OEM Get/Set Config function
12. [OOB] Fix the display of Activate BIOS Product Key
13. Fix the failure of login while using AD server that is configured to have longer length of user domain
14. Fix Self-Signed Certificate works, and signed Certificate by CA.

3.19

1. Fix the security issue: Don't allow inputting the special characters on the user name and password field.
2. Fix the issue that SOL is not working over SMASH.
3. Fix the issue that, when using I.E browser, on Radius Web Page, the settings values are intermittently missing.
4. Fix the issue that some valid character is not accepted on LDAP web page.
5. Add feature of SMC OEM RMCP, available on Miscellaneous->RAKP web page.
6. Enhance security function on the web.
7. Dynamic SSL Key is generated.
8. On login page, limit the username field to 15 and pwd to 19.