Re: CVE-2020-5344

[EXTERNAL EMAIL] 


bmcfwul seems to be the only executable in the package that needs a
newer glibc, if ldd is anything to go by.

Making it a static executable might do the job, and never to be looked
at again.

[email protected] writes:
> In this situation using racadm might be an option to consider? Scripted to either run locally on each target host with racadm installed on each, with the Dell Update Package centrally accessible by hosts or copied to each host or using racadm remote from a management workstation that can reach the iDRAC network.
> 
> Ex.
> racadm update -f /path/to/file
> racadm -r <idrac_ip|fqdn> -u root -p <password> update -f /path/to/file
> 
> In the first example /path/to/file is relative to the local target host
> In the second example /path/to/file is relative to the management workstation
> 
> Josh Moore
> Sr. Principal Engineer, Compute & Solutions Support Team, HPC SME
> Dell EMC | Infrastructure Solutions Support
> [email protected]  
> 
> How am I doing? Please contact my manager [email protected] to provide feedback. Thanks! 
> 
> Please consider the environment before printing this email. 
> 
> Confidentiality Notice: This email message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential or proprietary information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, immediately contact the sender by reply e-mail and destroy all copies of the original message.
> 
> -----Original Message-----
> From: linux-poweredge-bounces-Lists <[email protected]> On Behalf Of isdtor
> Sent: Thursday, April 9, 2020 11:49 AM
> To: linux-poweredge-Lists
> Subject: [Linux-PowerEdge] CVE-2020-5344
> 
> 
> [EXTERNAL EMAIL] 
> 
> 
> Hi list,
> 
> Can someone from Dell please explain how we can deploy security updates to machines where the OS is no longer supported, such as RHEL/CentOS 6? The upgrade below was downloaded from Dell's support web site, "Operating system" selected is "Red Hat(R) Enterprise Linux 6". And quite obviously, this doesn't work on RHEL 6 because glibc is version 2.12.
> 
> [root@host tmp]# ./iDRAC-with-Lifecycle-Controller_Firmware_KTC95_LN_4.10.10.10_A00.BIN -q Collecting inventory...
> ./bmcfwul: /lib64/libc.so.6: version `GLIBC_2.14' not found (required by ./bmcfwul) .
> Inventory collection failed.
> [root@host tmp]# 
> 
> I am aware I can extract the payload and upload to the iDRAC directly, but this is not practical when hundreds of servers need upgrading. Equally, the install from update CD method is also unworkable as it requires reboots, often in remote locations.
> 
> Is there a solution?
> 
> _______________________________________________
> Linux-PowerEdge mailing list
> [email protected]
> https://lists.us.dell.com/mailman/listinfo/linux-poweredge

> sh: tnef: command not found