IBM Power Systems Firmware: ASMI web interface performs admin actions from a page a logged-in admin visits

Impact

The Advanced System Management Interface accepts administrative requests that ride on an existing administrator session, so luring a logged-in ASMI administrator to a crafted web page can, under specific conditions, silently perform FSP administrative actions on their behalf. IBM rates the result as high integrity and availability impact to the managed system. The practical exposure is the operator's own browser: management workstations that keep an ASMI tab open are the delivery path, which is why this one is scored network-reachable and unauthenticated while still requiring user interaction. Affected levels span FW1120, FW1110, FW1060 and FW950.

Who can reach it

Anyone who can get a currently logged-in ASMI administrator to load attacker-controlled web content. The attacker needs no ASMI credentials and no network path to the management VLAN themselves — the administrator's browser supplies both.

What to do

Apply the fixed IBM firmware levels for the affected FW1120, FW1110, FW1060 and FW950 streams, which is a firmware flash on each managed system. Interim hygiene that does not require a maintenance window: log out of ASMI when not in use, drive ASMI only from a dedicated management browser or workstation, and do not browse the wider web from that session. The record does not state a vendor-supplied configuration mitigation.

References