× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.


  1.  Home
  2. MIDRANGE-L
  3. January 2015

RE: POODLE vs Firmware

I though the POODLE problem was fixed by turning off SSLv2 and SSLv3, not something that was being patched

Mike Cunningham

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Mark Murphy/STAR BASE Consulting Inc.
Sent: Thursday, January 22, 2015 2:28 PM
To: Midrange Systems Technical Discussion
Subject: RE: POODLE vs Firmware

POODLE is CVE-2014-3566. This is probably a different security leak.

Mark Murphy
STAR BASE Consulting, Inc.
mmurphy@xxxxxxxxxxxxxxx


-----rob@xxxxxxxxx wrote: -----
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
From: rob@xxxxxxxxx
Date: 01/12/2015 09:51AM
Subject: RE: POODLE vs Firmware

For some reasons IBM left off the word POODLE from the fix that you are currently at:
http://delivery04.dhe.ibm.com/sar/CMA/SFA/04m9q/0/01AL740_152_042.html
All the rest of the terminology sure smells like POODLE
HIPER/Pervasive: A security problem was fixed in the OpenSSL (Secure Socket Layer) protocol that allowed clients and servers, via a specially crafted handshake packet, to use weak keying material for communication. A man-in-the-middle attacker could use this flaw to decrypt and modify traffic between the management console and the service processor. The Common Vulnerabilities and Exposures issue number for this problem is CVE-2014-0224.
...

Then again, that may have been for a different security leak http://en.wikipedia.org/wiki/POODLE

The fix you have is dated 06/24/14 (see fix history from first URL), POODLE wasn't disclosed until September 2014 (see WIKI article above).
Maybe they don't have the fix ready for Power 7?


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 01/12/2015 09:31 AM
Subject: RE: POODLE vs Firmware
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

Power7 8205-E6C must be safe, I didn't receive any notifications.
Checked my current firmware, DSPFMWSTS, and then went to recommended fixes
Server Firmware: Update Policy Set to HMC to confirm latest.
Appears my firmware is current, no changes since 06/30/14.
Am I missing something?

DSPFMWSTS
Service partition . . . . . . . . . . . . . : Yes
Firmware update policy . . . . . . . . . . : *HMC
Server IPL source . . . . . . . . . . . . . : Temporary
Firmware product ID/release . . . . . . . . : 5733907 V1R3M0



--Server firmware-- -Operating system--
Fix PTF Fix PTF Update
Copy pack ID pack ID Status
*ACTIVE AL740_152 MH01418

*TEMP AL740_152 MH01418 *NONE *NONE None
*NONE
*PERM AL740_121 MH01376 *NONE *NONE None
*NONE

Recommended fixes Server Firmware: Update Policy Set to HMC

AL740_152_042 06/30/2014 View V7R1M0 -
MF51869

V6R1M1 - MF51864 AL740_152_042.rpm

AL740_152_042.xml

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Monday, January 12, 2015 8:46 AM
To: Midrange Systems Technical Discussion
Subject: RE: POODLE vs Firmware

These were automatic notifications that I signed up for based on hardware
I have or had. But, yes, there are firmware fixes for Power 7 firmware.

http://lmgtfy.com/?q=power+7+firmware+poodle+site%3Aibm.com

Granted there are those who feel that it's perfectly fine to put stuff on
your network like medical history, financials, payroll, high tech
engineering drawings, blueprints for nuclear weapons (don't ask, I'd have
to kill you), etc, but heaven forbid if you put your firmware access on
your network when that should only be on it's own private network.
Those people will smirk at concerns about poodle attacks on their
firmware.

Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'Midrange Systems Technical Discussion'"
<midrange-l@xxxxxxxxxxxx>
Date: 01/12/2015 08:29 AM
Subject: RE: POODLE vs Firmware
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>



Rob,

Any for Power7?

Paul

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
rob@xxxxxxxxx
Sent: Monday, January 12, 2015 7:37 AM
To: Midrange Systems Technical Discussion
Subject: Re: POODLE vs Firmware

Power 6's (of which I replaced all of mine - I had one of each of these.)

------------------------------------------------------------------------------
1. 8203-E4A systems

- TITLE: Microcode update for MTMs 8203-E4A; 9408-M25; 9407-M15; 8204-E8A;

9409-M50; etc.
- URL:
http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq?mode=18&ID=3946&myns=pwrmicro&mync=E&cm_sp=pwrmicro-_-NULL-_-E


- ABSTRACT: The latest service pack is now available for System firmware
level EL350 for MTMs 8203-E4A; 9408-M25; 9407-M15; 8204-E8A; 9409-M50;
8261-E4S. This service pack addresses POODLE security issues and
recommends an HMC update. Please click on the above link for details.

------------------------------------------------------------------------------
2. 9117-MMA Systems

- TITLE: Microcode update for MTMs 9117-MMA; 8234-EMA; 9406-MMA
- URL:
http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq?mode=18&ID=3953&myns=pwrmicro&mync=E&cm_sp=pwrmicro-_-NULL-_-E


- ABSTRACT: The latest service pack is now available for System firmware
level EM350 for MTMs 9117-MMA; 8234-EMA; 9406-MMA. This service pack
addresses POODLE security issues and recommends an HMC update. Please
click on the above link for details.

------------------------------------------------------------------------------
3. 9408-M25 systems

- TITLE: Microcode update for MTMs 8203-E4A; 9408-M25; 9407-M15; 8204-E8A;

9409-M50; etc.
- URL:
http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq?mode=18&ID=3950&myns=pwrmicro&mync=E&cm_sp=pwrmicro-_-NULL-_-E


- ABSTRACT: The latest service pack is now available for System firmware
level EL350 for MTMs 8203-E4A; 9408-M25; 9407-M15; 8204-E8A; 9409-M50;
8261-E4S. This service pack addresses POODLE security issues and
recommends an HMC update. Please click on the above link for details.

------------------------------------------------------------------------------


Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail
to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...
Follow-Ups:
Replies:
Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.