IPMI Cipher Zero vulnerability on server 2012?

Posted on 2016-09-19
Medium Priority
Last Modified: 2016-10-06
I got a vulnerability report stating that my server 2012 has the ipmi cipher vuln but its pointing to my server address and not the idrac. Any idea if a server can have this vulnerability?
Question by:Larry Kiterling
1 Comment
LVL 66

Accepted Solution

btan earned 2000 total points
ID: 41805870
should not be the win server since it is not running ipmi, even though it is hosted by the dell idrac
You can test using nmap
nmap -sU --script ipmi-cipher-zero -p 623 <host>

623/udp open|filtered unknown no-response
| ipmi-cipher-zero:
|   IPMI 2.0 RAKP Cipher Zero Authentication Bypass
|     State: VULNERABLE
|     Risk factor: High
|     Description:
or ipmitool
$ ipmitool -I lanplus -H -U Administrator -P FluffyWabbit user list
Error: Unable to establish IPMI v2 / RMCP+ session
Get User Access command failed (channel 14, user 1)

$ ipmitool -I lanplus -C 0 -H -U Administrator -P FluffyWabbit user list

ID  Name        Callin  Link Auth    IPMI Msg  Channel Priv Limit
1  Administrator    true    false      true      ADMINISTRATOR
2  (Empty User)    true    false      false      NO ACCESS

Featured Post

Will You Be GDPR Compliant by 5/28/2018?

GDPR? That's a regulation for the European Union. But, if you collect data from customers or employees within the EU, then you need to know about GDPR and make sure your organization is compliant by May 2018. Check out our preparation checklist to make sure you're on track today!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Understanding the various editions available is vital when you decide to purchase Windows Server 2012. You need to have a basic understanding of the features and limitations in each edition in order to make a well-informed decision that best suits …
In computing, Vulnerability assessment and penetration testing are used to assess systems in light of the organization's security posture, but they have different purposes.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

607 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question