Oracle ZFS Storage Appliance: Critical Security bug fixes for ZFSSA BIOS/ILOM (April 2017)

Asset ID:	1-72-2280467.1
Update Date:	2018-02-17
Keywords:

Solution Type Problem Resolution Sure

Solution 2280467.1 : Oracle ZFS Storage Appliance: Critical Security bug fixes for ZFSSA BIOS/ILOM (April 2017)

Applies to:

Oracle ZFS Storage Appliance Racked System ZS4-4 - Version All Versions and later
Sun Storage 7410 Unified Storage System - Version All Versions and later
Sun Storage 7310 Unified Storage System - Version All Versions and later
Sun Storage 7210 Unified Storage System - Version All Versions and later
Oracle ZFS Storage ZS3-4 - Version All Versions and later
7000 Appliance OS (Fishworks)

Symptoms

Critical Security bug fixes for the Oracle ZFS Storage Appliance platforms are now available (April 2017).

The bug fixes take the form of BIOS/ILOM upgrade patches.

Cause

Oracle ZFS Storage Appliance platform BIOS/ILOM security bug fixes.

Solution

Please upgrade to the latest available BIOS/ILOM version for the specific platform.

PLEASE NOTE: For 7x10, 7x20, ZS3-4 and ZS3-BA systems, if it is determined that the BIOS/ILOM version needs to be upgraded this MUST be done through Oracle support - Open a Service Request for assistance, OR via an Oracle Certified Partner.

NOTE for OS8.7.x: Appliance Firmware Release OS 8.7 contains functionality to automatically upgrade the ILOM/BIOS for ZS5-2, ZS5-4, ZS4-4 and ZS3-2 ZFS Storage Appliances (See Doc ID 2285244.1)

NOTE: To determine the 'currently running' BIOS/ILOM version, and/or to discover the latest available BIOS/ILOM versions, please see Doc ID 1174698.1 - How to check the SP BIOS revision level.

7x10 component firmware

NOTE: There are NO plans to upgrade the 7x10 Appliance BIOS/ILOM firmware

7x20 component firmware

Sun Storage 7120/7320 (Sun Fire X4170 M2 Server/Sun Fire X4270 M2 Server - Lynx+)

NOTE: THERE IS NO APRIL 17 CPU RELEASE FOR 7120/7320.

Sun Storage 7420 (Sun Fire X4470 - Callisto)

SW 1.10.0 ILOM 3.2.9.25 r116305 BIOS 09.05.07.00

SW 1.10.0 ILOM 3.2.9.25 r116305 BIOS 09.05.07.00 patchId 25925787

Reference: MOS Doc ID 1357409.1 - Sun ZFS Storage Appliance: How to update the BIOS for a 7x20 NAS appliance

See also: MOS Doc ID 2107975.1 - Sun ZFS Storage Appliance: 7420 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

Sun Storage 7420 M2 (Sun Fire X4470 M2 - Callisto +)

SW 1.9.0 ILOM 3.2.9.25 r116305 BIOS 16.04.05.00

SW 1.9.0 ILOM 3.2.9.25 r116305 BIOS 16.04.05.00 patchId 25926001

Reference: MOS Doc ID 1357409.1 - Sun ZFS Storage Appliance: How to update the BIOS for a 7x20 NAS appliance

See also: MOS Doc ID 2107975.1 - Sun ZFS Storage Appliance: 7420 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

ZS3-x component firmware

ZS3-2 (Netra X3-2 Server /Sun Netra X4270 M3 Server Concord)

SW 1.5.0 ILOM 3.2.9.21 r117708 BIOS 21.00.02.27

SW 1.5.0 ILOM 3.2.9.21 r117708 BIOS 21.00.02.27 patchId 26222939

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS3-2+Motherboard+Replacement

See also: MOS Doc ID 2109014.1 - Oracle ZFS Storage Appliance: ZS3-2 - Required BIOS Settings

*See also Important Note 2 below

ZS3-4/ZS3-BA (Sun Server X2-4 / Sun Fire X4470 M2 Callisto+)

SW 1.9.0 ILOM 3.2.9.25 r116305 BIOS 16.04.05.00

SW 1.9.0 ILOM 3.2.9.25 r116305 BIOS 16.04.05.00 patchId 25926001

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS3-4+Motherboard+Replacement

See also: MOS Doc ID 2110944.1 - Oracle ZFS Storage Appliance: ZS3-4 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

ZS3-ES (Sun Server X3-2 / Sun Fire X4170 M3 Nashua)

SW 1.7.0 ILOM 3.2.9.22 r115963 BIOS 17.12.01.00

SW 1.7.0 ILOM 3.2.9.22 r115963 BIOS 17.12.01.00 patchId 25971852

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/content/dav/st/ZFSSAFieldSupport/Public%20Documents/PDF_Files/ZS3-ES_MB_Replacement_Procedure.pdf

See also: MOS Doc ID 2194478.1 - Oracle ZFS Storage Appliance: ZS3-ES - Required BIOS Settings

ZS4-x component firmware

ZS4-4 (Sun Server X4-4 Callisto)

SW 1.6.0 ILOM 3.2.9.25 r116415 BIOS 24.07.03.00

SW 1.6.0 ILOM 3.2.9.25 r116415 BIOS 24.07.03.00 patchId 25920259

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS4-4+Motherboard+Replacement

See also: MOS Doc ID 2110999.1 - Oracle ZFS Storage Appliance: ZS4-4 - Required BIOS Settings

ZS5-x component firmware

ZS5-2 (Netra Server X5-2)

SW 1.3.0 ILOM 3.2.9.21 r116436 BIOS 32.00.01.13

SW 1.3.0 ILOM 3.2.9.21 r116436 BIOS 32.00.01.13 patchId 25968477

Reference: Check/Configure BIOS Settings - ZFSSA Field Service Manual (page 472)

See also: MOS Doc ID 2218668.1 - Oracle ZFS Storage Appliance: ZS5-2 - Required BIOS Settings

ZS5-4 (Oracle Server X5-4)

SW 1.4.0 ILOM 3.2.9.25 r116305 BIOS 36.04.02.00

SW 1.4.0 ILOM 3.2.9.25 r116305 BIOS 36.04.02.00 patchId 25920070

Reference: Check/Configure BIOS Settings - ZFSSA Field Service Manual (page 196)

See also: MOS Doc ID 2217150.1 - Oracle ZFS Storage Appliance: ZS5-4 - Required BIOS Settings

ZS5-ES (Oracle Server X5-2)

SW 1.9.0 ILOM 3.2.9.23 r116695 BIOS 30.11.00.00

SW 1.9.0 ILOM 3.2.9.23 r116695 BIOS 30.11.00.00 patchId 25964384

Note 1:

There is no option to preserve BIOS configuration during the ILOM/BIOS upgrade for this platform.

After the SW update, the BIOS configuration needs to be manually set as described in the "Configure BIOS" section of the corresponding platform motherboard replacement procedure.

Important Note 2:

This note applies to any ILOM/BIOS upgrade from a version earlier than 3.2.6 to this new ILOM/BIOS version for any platform and irrespective of any AK version.

If the system is currently running an ILOM version of 3.2.6.x (or later) it is not affected.

ILOM/BIOS 3.2.6 update addendum

Issue: AK allows users to create password that has no restrictions in terms of password length etc. But recent release of ILOM/BIOS, based on ILOM branch 3.2.6 and later has
introduced a password restriction. This restriction will prevent the Host Appliance Kit (AK) from being able to continue the current practice of using passwords less than 8 character long.
In order to continue allow the current AK practice of no restriction, the upgrade of ILOM/BIOS needs to follow the new procedure to upgrade the ILOM/BIOS.

To preserve the current settings and preserve all the accounts/passwords, a bash script should be run from a remote Linux/Solaris system with SFTP service enabled, that will
automatically preserve the logins and passwords and sets the password length to a minimum level of 1.

For details, please see

https://stbeehive.oracle.com/content/dav/st/ZFSSAFieldSupport/Public%20Documents/ILOMUpdateAddendumTJV1.2.odt

If you have difficulties accessing the above page, please contact NAS TSC.

NOTE: Be aware of the issue outlined in MOS Doc ID 2205130.1 (Oracle ZFS Storage Appliance: SP/BIOS Upgrade via ILOM BUI Fails with "Package structure is corrupted")

Uploading the new patches in the BUI gives a message that the package structure is corrupted - you have to load the patch using FTP, HTTP or TFTP.

References

<NOTE:2205130.1> - Oracle ZFS Storage Appliance: SP/BIOS Upgrade via ILOM BUI Fails with "Package structure is corrupted"

Attachments

This solution has no attachment