Unaddressed Vulnerability Found in Lighttpd Server Embedded in Intel and Lenovo BMCs
Binarly's recent findings reveal a security loophole in the Lighttpd web server utilized within baseboard management controllers (BMCs), left unaddressed by major device manufacturers like Intel and Lenovo. Originally discovered and patched by Lighttpd maintainers in August 2018, the absence of a CVE identifier or advisory led to its oversight by developers of AMI MegaRAC BMC, thus integrating it into Intel and Lenovo products.
Lighttpd, known for its speed, security, and efficiency, harbored an out-of-bounds read vulnerability silently fixed by Lighttpd maintainers, which could facilitate data exfiltration, including process memory addresses, undermining crucial security measures like ASLR.
Binarly emphasizes the detrimental impact of lacking prompt and critical security information, hindering effective handling of fixes along firmware and software supply chains.
The identified flaws include out-of-bounds reads in Lighttpd versions utilized in Intel M70KLP series firmware and Lenovo BMC firmware, predating version 1.4.51.
Intel and Lenovo have chosen not to rectify the issue, citing end-of-life (EoL) status for affected products, rendering them ineligible for security updates and perpetuating the vulnerability indefinitely.
This disclosure underscores how outdated third-party components in firmware updates can propagate through the supply chain, posing unintended security hazards for end users, according to Binarly.
Source: https://thehackernews.com/2024/04/intel-and-lenovo-bmcs-contain-unpatched.html