Description
Apple Xserve Lights-Out Management before Firmware Update 1.0 on Intel hardware does not require a password for remote access to IPMI, which allows remote attackers to gain administrative access via unspecified requests with ipmitool.
References
- APPLE-SA-2007-05-31 vendor-advisory
- xserve-ipmi-privilege-escalation(34651) vdb-entry
- 36128 vdb-entry
- 1018181 vdb-entry
- 24257 vdb-entry
- ADV-2007-2014 vdb-entry
- 25499 third-party-advisory
- http://docs.info.apple.com/article.html?artnum=305571
- http://www.apple.com/support/downloads/xservelightsoutmanagementfirmwareupdate10.html