Search This Blog

Showing posts with label HP. Show all posts

HP Issues Advisory Informing Users to Expect SSD Failure around October 2020


Computer enterprise company HP (Hewlett Packard Enterprise) warns its customers about a bug that it has recently found in its SSD (Solid State Drives). The company HP has made a new firmware patch to prevent some of its hard drives from crashing after 40,000 hours of consumer use. In a firmware incident last week, HP informed its consumers about a bug in some of its hard drives that will cause them to stop working after 40,000 hours of use, which is around four years and 200 days. SAS SSDs (Serial-Attached SCSI solid-state drives) is the model of the hard drives that are likely to be affected by this firmware bug.


According to HP, the hard disks manufactured during that period will crash around October this year, and these will be among the earliest failures. To solve this issue, HP has released some firmware updates to fix this bug last week. It has asked the companies to update to the latest firmware updates, and if they fail to do so, the companies might risk losing both the SSD and the data. If the SSD crashes, users can't restore their data, says HP in its security advisory.

This firmware bug incident is similar to another hard drive crash incident that happened in November last year. In the latter event, the HPE SAS SSDs crashed after nearly three years and 270 days of use. This time, however, this bug will affect far fewer SSDs than it did last year. According to HP, the company learned about this issue from a different SSD company that uses HP's SSDs, similar to last year. The list of SAS SSD models affected by the bug is available on HP's customer support website.

"This HPD8 firmware is considered a critical fix and is required to address the issue detailed below. HPE strongly recommends the immediate application of this crucial fixture. Neglecting to update to SSD Firmware Version HPD8 will result in drive failure and data loss at 32,768 hours of operation and require restoration of data from the backup in non-fault tolerance, such as RAID 0 and fault tolerance RAID mode if more drives fail than what is supported by the fault tolerance RAID mode logical drive," reads HP's notification.

Vulnerability In HP Takes Into Consideration Remote Code Execution



Vulnerability has been found in HPE Integrated Lights-Out 4 (iLO 4) servers, which could take into consideration remote code execution. In spite of the fact that it was first discovered on February 2017, yet was released with patches in August 2017.

HPE iLO 4 is an embedded server management tool utilized for out-of-band administration. The fruitful exploitation of this vulnerability is said to bring about remote code execution or even at times authentication bypass, as well as extraction of plaintext passwords, addition of an administrator account, execution of malicious code, or replacement of iLO firmware.

This vulnerability in iLO cards can be utilized to break into numerous organizations' networks and perhaps access exceptionally delicate or restrictive data as these devices are, to a great degree prominent among the small and the large enterprises alike.

The trio of security researchers, who found the vulnerability CVE-2017-12542 a year ago, say that it can be exploited remotely, by means of an Internet connection, putting all iLO servers exposed online in danger.

Additionally including later that it is essentially a verification sidestep that permits attackers access to HP iLO consoles and this access can later be utilized to remove cleartext passwords, execute noxious code, and even supplant iLO firmware. Execution of the vulnerability requires the attacker to cURL to the influenced server, trailed by 29 "A" characters.

Researchers published two GIFs showing how easy are to bypass iLO authentication with their method, and how they were able to retrieve a local user's password in cleartext.



Extra subtle elements on the vulnerability and exploit code were as of late distributed in different open-source media reports, and a Metasploit module was also made accessible, altogether expanding the hazard to vulnerable systems.

In any case, iLO server proprietors do not have any reason to panic as since security research team found this vulnerability path back in February 2017 they notified HP with the assistance of the CERT division at Airbus.

What's more, as far as it concerns HP released patches for CVE-2017-12542 in August a year ago, in iLO 4 firmware version 2.54. System administrators who're in the propensity for frequently fixing servers are undoubtedly secured against this bug for quite a long time.