Oracle ZFS Storage Appliance: Critical Security bug fixes for ZFSSA BIOS/ILOM (October 2017)

Asset ID:	1-72-2351298.1
Update Date:	2018-01-23
Keywords:

Solution Type Problem Resolution Sure

Solution 2351298.1 : Oracle ZFS Storage Appliance: Critical Security bug fixes for ZFSSA BIOS/ILOM (October 2017)

Applies to:

Oracle ZFS Storage ZS5-2 - Version All Versions and later
Oracle ZFS Storage ZS4-4 - Version All Versions and later
Sun Storage 7110 Unified Storage System - Version All Versions and later
Sun ZFS Storage 7420 - Version All Versions and later
Sun ZFS Storage 7320 - Version All Versions and later
7000 Appliance OS (Fishworks)

Symptoms

Critical Security bug fixes for the Oracle ZFS Storage Appliance platforms are now available (October 2017).

The bug fixes take the form of BIOS/ILOM upgrade patches.

Cause

Oracle ZFS Storage Appliance platform BIOS/ILOM security bug fixes.

Solution

Please upgrade to the latest available BIOS/ILOM version for the specific platform.

PLEASE NOTE: For 7x10, 7x20, ZS3-4 and ZS3-BA systems, if it is determined that the BIOS/ILOM version needs to be upgraded this MUST be done through Oracle support - Open a Service Request for assistance, OR via an Oracle Certified Partner.

NOTE for OS8.7.x: Appliance Firmware Release OS 8.7 contains functionality to automatically upgrade the ILOM/BIOS for ZS5-2, ZS5-4, ZS4-4 and ZS3-2 ZFS Storage Appliances (See Doc ID 2285244.1)

NOTE: The ILOM/BIOS versions given in THIS DOCUMENT are not yet available for the 'ILOM/BIOS auto-upgrade' procedure.

NOTE: To determine the 'currently running' BIOS/ILOM version, and/or to discover the latest available BIOS/ILOM versions, please see Doc ID 1174698.1 - How to check the SP BIOS revision level.

7x10 component firmware

NOTE: There are NO plans to upgrade the 7x10 Appliance BIOS/ILOM firmware

7x20 component firmware

Sun Storage 7120/7320 (Sun Fire X4170 M2 Server/Sun Fire X4270 M2 Server - Lynx+)

NOTE: THERE IS NO OCTOBER 17 CPU RELEASE FOR 7120/7320.

Sun Storage 7420 (Sun Fire X4470 - Callisto)

SW 1.11.1 ILOM 3.2.10.21.a r120301 BIOS 09.05.07.00

SW 1.11.1 ILOM 3.2.10.21.a r120301 BIOS 09.05.07.00 patchId 26955932

Reference: MOS Doc ID 1357409.1 - Sun ZFS Storage Appliance: How to update the BIOS for a 7x20 NAS appliance

See also: MOS Doc ID 2107975.1 - Sun ZFS Storage Appliance: 7420 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

Sun Storage 7420 M2 (Sun Fire X4470 M2 - Callisto +)

SW 1.10.1 ILOM 3.2.10.21.a r120301 BIOS 16.04.05.00

SW 1.10.1 ILOM 3.2.10.21.a r120301 BIOS 16.04.05.00 patchId 26956921

Reference: MOS Doc ID 1357409.1 - Sun ZFS Storage Appliance: How to update the BIOS for a 7x20 NAS appliance

See also: MOS Doc ID 2107975.1 - Sun ZFS Storage Appliance: 7420 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

ZS3-x component firmware

ZS3-2 (Netra X3-2 Server /Sun Netra X4270 M3 Server Concord)

SW 1.6.0 ILOM 3.2.10.23 r121982 BIOS 21.00.02.28

SW 1.6.0 ILOM 3.2.10.23 r121982 BIOS 21.00.02.28 patchId 27052021

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS3-2+Motherboard+Replacement

See also: MOS Doc ID 2109014.1 - Oracle ZFS Storage Appliance: ZS3-2 - Required BIOS Settings

*See also Important Note 2 below

ZS3-4/ZS3-BA (Sun Server X2-4 / Sun Fire X4470 M2 Callisto+)

SW 1.10.1 ILOM 3.2.10.21.a r120301 BIOS 16.04.05.00

SW 1.10.1 ILOM 3.2.10.21.a r120301 BIOS 16.04.05.00 patchId 26956921

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS3-4+Motherboard+Replacement

See also: MOS Doc ID 2110944.1 - Oracle ZFS Storage Appliance: ZS3-4 - Required BIOS Settings

*See Note 1 below

*See also Important Note 2 below

ZS3-ES (Sun Server X3-2 / Sun Fire X4170 M3 Nashua)

SW 1.9.0 ILOM 3.2.10.22.a r121452 BIOS 17.13.01.00

SW 1.9.0 ILOM 3.2.10.22.a r121452 BIOS 17.13.01.00 patchId 26976955

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/content/dav/st/ZFSSAFieldSupport/Public%20Documents/PDF_Files/ZS3-ES_MB_Replacement_Procedure.pdf

See also: MOS Doc ID 2194478.1 - Oracle ZFS Storage Appliance: ZS3-ES - Required BIOS Settings

ZS4-x component firmware

ZS4-4 (Sun Server X4-4 Callisto)

SW 1.7.1 ILOM 3.2.10.21.a r121424 BIOS 24.08.01.00

SW 1.7.1 ILOM 3.2.10.21.a r121424 BIOS 24.08.01.00 patchId 26948105

Reference: Check/Configure BIOS Settings - https://stbeehive.oracle.com/teamcollab/wiki/ZFSSAFieldSupport:ZS4-4+Motherboard+Replacement

See also: MOS Doc ID 2110999.1 - Oracle ZFS Storage Appliance: ZS4-4 - Required BIOS Settings

ZS5-x component firmware

ZS5-2 (Netra Server X5-2)

SW 1.4.0 ILOM 3.2.10.23 r121982 BIOS 32.00.01.16

SW 1.4.0 ILOM 3.2.10.23 r121982 BIOS 32.00.01.16 patchId 27063694

Reference: Check/Configure BIOS Settings - ZFSSA Field Service Manual (page 472)

See also: MOS Doc ID 2218668.1 - Oracle ZFS Storage Appliance: ZS5-2 - Required BIOS Settings

ZS5-4 (Oracle Server X5-4)

SW 2.0.0 ILOM 4.0.0.25 r121443 BIOS 36.05.01.00

SW 2.0.0 ILOM 4.0.0.25 r121443 BIOS 36.05.01.00 patchId 26948450

Reference: Check/Configure BIOS Settings - ZFSSA Field Service Manual (page 196)

See also: MOS Doc ID 2217150.1 - Oracle ZFS Storage Appliance: ZS5-4 - Required BIOS Settings

ZS5-ES (Oracle Server X5-2)

SW 2.0.0 ILOM 4.0.0.24 r121523 BIOS 30.13.02.00

SW 2.0.0 ILOM 4.0.0.24 r121523 BIOS 30.13.02.00 patchid 26977381

Note 1:

There is no option to preserve BIOS configuration during the ILOM/BIOS upgrade for this platform.

After the SW update, the BIOS configuration needs to be manually set as described in the "Configure BIOS" section of the corresponding platform motherboard replacement procedure.

Important Note 2:

This note applies to any ILOM/BIOS upgrade from a version earlier than 3.2.6 to this new ILOM/BIOS version for any platform and irrespective of any AK version.

If the system is currently running an ILOM version of 3.2.6.x (or later) it is not affected.

ILOM/BIOS 3.2.6 update addendum

Issue: AK allows users to create password that has no restrictions in terms of password length etc. But recent release of ILOM/BIOS, based on ILOM branch 3.2.6 and later has
introduced a password restriction. This restriction will prevent the Host Appliance Kit (AK) from being able to continue the current practice of using passwords less than 8 character long.
In order to continue allow the current AK practice of no restriction, the upgrade of ILOM/BIOS needs to follow the new procedure to upgrade the ILOM/BIOS.

To preserve the current settings and preserve all the accounts/passwords, a bash script should be run from a remote Linux/Solaris system with SFTP service enabled, that will
automatically preserve the logins and passwords and sets the password length to a minimum level of 1.

For details, please see

https://stbeehive.oracle.com/content/dav/st/ZFSSAFieldSupport/Public%20Documents/ILOMUpdateAddendumTJV1.2.odt

If you have difficulties accessing the above page, please contact NAS TSC.

NOTE: Be aware of the issue outlined in MOS Doc ID 2205130.1 (Oracle ZFS Storage Appliance: SP/BIOS Upgrade via ILOM BUI Fails with "Package structure is corrupted")

Uploading the new patches in the BUI gives a message that the package structure is corrupted - you have to load the patch using FTP, HTTP or TFTP.

Attachments

This solution has no attachment