Asset ID:	1-77-1019926.1
Update Date:	2014-06-13
Keywords:

---

Solution Type  Sun Alert Sure

Solution  1019926.1 :   Incorrect Software Setting Prior to Shipping on Certain Sun SPARC M4000/M5000 Servers May Allow Unauthorized Access  


PreviouslyPublishedAs
249126

Bug Id
<BUG: 15531144>

Product
Sun SPARC Enterprise M4000 Server
Sun SPARC Enterprise M5000 Server

Date of Resolved Release
12-Jan-2009

Incorrect software setting prior to shipping on certain Sun SPARC M4000/M5000 servers may allow unauthorized access

1. Impact

Due to incorrect software settings prior to shipping on certain Sun SPARC
Enterprise M4000/M5000 servers the following issues will be seen:

- Some system features and commands will not behave as expected 
- If an error is reported by the Solaris Fault Management Architecture
  (FMA) the message will contain an incorrect URL.
- Sun Management Center(SunMC) fails to run on the system  
- A local or remote user may be able to log in as root to the eXtended
  System Control Facility Unit (XSCFU), also known as the Service Processor.

2. Contributing Factors

This issue can occur on the following platforms:

• SPARC Enterprise M4000/M5000 Servers with serial numbers for the weeks of 38 through 49 of 2008
  

The serial number can be used to determine the affected weeks. To obtain the system serial number, use the "showhardconf" command at the XSCF prompt:

    XSCF> showhardconf
    SPARC Enterprise M5000;
    + Serial:BCF084604T; Operator_Panel_Switch:Service;
    Power_Supply_System:Single; SCF-ID:XSCF#0;
    ------ Deleted additional output ---------------

Serial number breakdown to determine affected weeks:

    PPMYYWWSSS

    PP is a factory code
    M is a model code
    YY is the last two digits of the year
    WW is the week of the calendar year
    SSS is a hexidecimal or alphanumeric sequence number

In the example above, serial number BCF084604T  indicates it is from week 46 of 2008.

3. Symptoms

If the described issue occurs, the OBP Banner or Browser User Interface (BUI) may display a non-Sun brand.

Another symptom can be seen when typing the keyboard sequence <tab><tab> at the XSCF prompt with the current user in "Normal" mode. This sequence will display a list of all available commands. If the command "enablecodboard" is present in the list, the described issue has been experienced.

4. Workaround

There is no workaround for this issue.  Please see the Resolution below.

5. Resolution

If you believe you have an affected system, a Sun Service Request needs to be opened to correct the manufacturing settings.

Typically this issue can be fixed using Shared Shell (see: http://oracle.com/us/support/premier/shared-shell-sun-systems-163755.html).

For more information on Security Sun Alerts, see <Document: 1009886.1>.



Modification History
19-Jan-2009: Updated Impact section.
13-Jun-2014: Corrected link in Resolution section

Internal Contributor/submitter
Ken.Kambic@sun.com
Internal Eng Responsible Engineer
James.Hsieh@Sun.COM
Internal Services Knowledge Engineer
jeff.folla@sun.com
Internal Eng Business Unit Group
SSG ES (Enterprise Systems)
Internal Comments
Please send technical questions to the following email:

  sunalert-tech-questions@sun.com

and CC the following persons:

  Internal Contributor/Submitter

  Internal Eng Responsible Engineer

Attachments

This solution has no attachment