Oracle ZFS Storage Appliance: Critical Security bug fixes for ZFSSA BIOS/ILOM (October 2016)

Asset ID:	1-72-2222104.1
Update Date:	2018-01-23
Keywords:

Solution Type Problem Resolution Sure

Solution 2222104.1 : Oracle ZFS Storage Appliance: Critical Security bug fixes for ZFSSA BIOS/ILOM (October 2016)

Applies to:

Sun ZFS Storage 7320 - Version All Versions and later
Sun ZFS Storage 7120 - Version All Versions and later
Oracle ZFS Storage ZS5-4 - Version All Versions and later
Oracle ZFS Storage ZS4-4 - Version All Versions and later
Oracle ZFS Storage ZS3-4 - Version All Versions and later
7000 Appliance OS (Fishworks)

Symptoms

Critical Security bug fixes for the Oracle ZFS Storage Appliance platforms are now available (October 2016).

The bug fixes take the form of BIOS/ILOM upgrade patches.

Cause

Oracle ZFS Storage Appliance platform BIOS/ILOM security bug fixes.

Solution

Please upgrade to the latest available BIOS/ILOM version for the specific platform.

PLEASE NOTE: If it is determined that the BIOS/ILOM version needs to be upgraded this MUST be done through Oracle support - Open a Service Request for assistance, OR via an Oracle Certified Partner.

NOTE for OS8.7.x: Appliance Firmware Release OS 8.7 contains functionality to automatically upgrade the ILOM/BIOS for ZS5-2, ZS5-4, ZS4-4 and ZS3-2 ZFS Storage Appliances (See Doc ID 2285244.1)

NOTE: To determine the 'currently running' BIOS/ILOM version, and/or to discover the latest available BIOS/ILOM versions, please see Doc Id 1174698.1 - How to check the SP BIOS revision level.

7x10 component firmware

NOTE: There are NO plans to upgrade the 7x10 Appliance BIOS/ILOM firmware

7x20 component firmware

Sun Storage 7120/7320 (Lynx+)

SW 1.8 ILOM 3.2.7.30a r112904, BIOS 08.14.01.12

SW 1.8 ILOM 3.2.7.30a r112904, BIOS 08.14.01.12 patchId 24901335

Important Note: This Patch will state that it is for a X4270 M2 but it will work on a X4170 M2.

Reference: MOS Doc ID 1357409.1 - Sun ZFS Storage Appliance: How to update the BIOS for a 7x20 NAS appliance

See also: MOS Doc ID 2107965.1 - Sun ZFS Storage Appliance: 7120 - Required BIOS Settings

See also: MOS Doc ID 2107971.1 - Sun ZFS Storage Appliance: 7320 - Required BIOS Settings

*See Note 1 below

Sun Storage 7420 (Callisto)

SW 1.8.0 ILOM 3.2.7.20a r112614, BIOS 09.05.07.00

SW 1.8.0 ILOM 3.2.7.20a r112614, BIOS 09.05.07.00 patchId 24838465

Reference: MOS Doc ID 1357409.1 - Sun ZFS Storage Appliance: How to update the BIOS for a 7x20 NAS appliance

See also: MOS Doc ID 2107975.1 - Sun ZFS Storage Appliance: 7420 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

Sun Storage 7420 M2 (Callisto +)

SW 1.7 ILOM 3.2.7.20a r112614, BIOS 16.04.05.00

SW 1.7 ILOM 3.2.7.20a r112614, BIOS 16.04.05.00 patchId 24838572

Reference: MOS Doc ID 1357409.1 - Sun ZFS Storage Appliance: How to update the BIOS for a 7x20 NAS appliance

See also: MOS Doc ID 2107975.1 - Sun ZFS Storage Appliance: 7420 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

ZS3-x component firmware

ZS3-2 (Netra X3-2 Server /Sun Netra X4270 M3 Server Concord)

SW 1.4 ILOM 3.2.7.24 r113669, BIOS 21.00.02.27

Note: Package source is - http://osarelease.us.oracle.com/osa/nile/1.4/builds/r86371/internal/Sun_Netra_X4270_M3-1.4.0.86371-ALL_PACKS-internal/Firmware/service-processor/ILOM-3_2_7_24_r113669-SUN_Netra_X4270_M3.pkg

SW 1.4 ILOM 3.2.7.24 r113669, BIOS 21.00.02.27 patchId 25293509

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS3-2+Motherboard+Replacement

See also: MOS Doc ID 2109014.1 - Oracle ZFS Storage Appliance: ZS3-2 - Required BIOS Settings

*See also Important Note 2 below

ZS3-4/ZS3-BA (Sun Server X2-4 / Sun Fire X4470 M2 Callisto+)

SW 1.7 ILOM 3.2.7.20a r112614, BIOS 16.04.05.00

SW 1.7 ILOM 3.2.7.20a r112614, BIOS 16.04.05.00 patchId 24838572

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS3-4+Motherboard+Replacement

See also: MOS Doc ID 2110944.1 - Oracle ZFS Storage Appliance: ZS3-4 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

ZS3-ES (Sun Server X3-2 / Sun Fire X4170 M3 Nashua)

SW 1.5 ILOM 3.2.7.32a r112581, BIOS 17.11.05.00

SW 1.5 ILOM 3.2.7.32a r112581, BIOS 17.11.05.00 patchId 24900857

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/content/dav/st/ZFSSAFieldSupport/Public%20Documents/PDF_Files/ZS3-ES_MB_Replacement_Procedure.pdf

See also: MOS Doc ID 2194478.1 - Oracle ZFS Storage Appliance: ZS3-ES - Required BIOS Settings

ZS4-x component firmware

ZS4-4 (Sun Server X4-4 Callisto)

SW 1.4 ILOM 3.2.7.20a r112614, BIOS 24.06.02.00

SW 1.4 ILOM 3.2.7.20a r112614, BIOS 24.06.02.00 patchId 24826023

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS4-4+Motherboard+Replacement

See also: MOS Doc ID 2110999.1 - Oracle ZFS Storage Appliance: ZS4-4 - Required BIOS Settings

*See also Important Note 2 below

ZS5-x component firmware

ZS5-2 (Netra Server X5-2)

SW 1.2 RC2 ILOM 3.2.7.24 r113383, BIOS 32.00.01.09

SW 1.2 RC2 ILOM 3.2.7.24 r113383, BIOS 32.00.01.09 package

Note: Package source is - http://osarelease.us.oracle.com/osa/netra-x5-2/1.2/builds/r86306/internal/Netra_Server_X5-2-1.2.0.86306-ALL_PACKS-internal/Firmware/service-processor/ILOM-3_2_7_24_r113383-Netra_Server_X5-2.pkg

Reference: Check/Configure BIOS Settings - ZFSSA Field Service Manual (page 472)

See also: MOS Doc ID 2218668.1 - Oracle ZFS Storage Appliance: ZS5-2 - Required BIOS Settings

ZS5-4 (Oracle Server X5-4)

SW 1.2 ILOM 3.2.7.20a r112614, BIOS 36.03.03.00

SW 1.2 ILOM 3.2.7.20a r112614, BIOS 36.03.03.00 patchId 24841470

Reference: Check/Configure BIOS Settings - ZFSSA Field Service Manual (page 196)

See also: MOS Doc ID 2217150.1 - Oracle ZFS Storage Appliance: ZS5-4 - Required BIOS Settings

ZS5-ES (Oracle Server X5-2)

SW 1.7.0 ILOM 3.2.7.26a r112579, BIOS 30.09.02.00

SW 1.7.0 ILOM 3.2.7.26a r112579, BIOS 30.09.02.00 patchId 24900822

Note 1:

There is no option to preserve BIOS configuration during the ILOM/BIOS upgrade for this platform.

After the SW update, the BIOS configuration needs to be manually set as described in the "Configure BIOS" section of the corresponding platform motherboard replacement procedure.

Important Note 2:

This note applies to any ILOM/BIOS upgrade from a version earlier than 3.2.6 to this new ILOM/BIOS version for any platform and irrespective of any AK version.

If the system is currently running an ILOM version of 3.2.6.x (or later) it is not affected.

ILOM/BIOS 3.2.6 update addendum

Issue: AK allows users to create password that has no restrictions in terms of password length etc. But recent release of ILOM/BIOS, based on ILOM branch 3.2.6 and later has
introduced a password restriction. This restriction will prevent the Host Appliance Kit (AK) from being able to continue the current practice of using passwords less than 8 character long.
In order to continue allow the current AK practice of no restriction, the upgrade of ILOM/BIOS needs to follow the new procedure to upgrade the ILOM/BIOS.

To preserve the current settings and preserve all the accounts/passwords, a bash script should be run from a remote Linux/Solaris system with SFTP service enabled, that will
automatically preserve the logins and passwords and sets the password length to a minimum level of 1.

For details, please see

https://stbeehive.oracle.com/content/dav/st/ZFSSAFieldSupport/Public%20Documents/ILOMUpdateAddendumTJV1.2.odt

If you have difficulties accessing the above page, please contact NAS TSC.

NOTE: Be aware of the issue outlined in MOS Doc ID 2205130.1 (Oracle ZFS Storage Appliance: SP/BIOS Upgrade via ILOM BUI Fails with "Package structure is corrupted")

Uploading the new patches in the BUI gives a message that the package structure is corrupted - you have to load the patch using FTP, HTTP or TFTP.

References

<NOTE:2205130.1> - Oracle ZFS Storage Appliance: SP/BIOS Upgrade via ILOM BUI Fails with "Package structure is corrupted"

Attachments

This solution has no attachment