Home / Security / Advisories / NTAP-20190305-0001

NTAP-20190305-0001 — CVE-2019-5490 Default Privileged Account Vulnerability in the NetApp Service Processor

Published 2019-03-05 · Updated 2019-04-11 · Status: Final · Exploitation: Not public · Severity: CRITICAL 9.8 · ONTAP affected: Yes

Official advisory: NTAP-20190305-0001 on security.netapp.com ↗. Affected versions, fixed releases, and workarounds live there — this page is a summary.

Product family: ONTAP · Other NetApp products | ONTAP-relevant | highest CVSS: 9.8

CVEs in this advisory

CVE-2019-5490 — CRITICAL · CVSS 9.8 · site index

What the CVE records say

CVE-2019-5490 — Certain versions between 2.x to 5.x (refer to advisory) of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixed version of Service Processor firmware IMMEDIATELY.

Impact

Exploitation of this vulnerability can result in unauthorized arbitrary command execution. <html> <body> First Fixed in Releases:  <table align="left" border="1" cellpadding="0" cellspacing="0"> <tbody> <tr> <td width="110"> SP Firmware </td> <td> Storage Systems </td> <td width="93"> ONTAP 9.5 </td> <td width="93"> ONTAP 9.4 </td> <td width="93"> ONTAP 9.3 </td> <td width="93"> ONTAP 9.2 </td> <td width="93"> ONTAP 9.1 </td> <td width="93"> ONTAP 9.0 </td> <td width="93"> ONTAP 8.3 </td> <td width="93"> ONTAP 8.2 </td> </tr> <tr> <td width="110"> SP 5.x </td> <td> AFF A300, AFF A200, FAS8200, FAS2650, FAS2620 </td> <td width="93"> 5.5P1 </td> <td width="93"> 5.5P1 </td> <td width="93"> 5.5P1 </td> <td width="93"> 5.2P2 </td> <td width="93"> 5.1P4 </td> <td width="93"> N/A </td> <td width="93"> N/A </td> <td width="93"> N/A </td> </tr> <tr> <td width="110"> SP 4.x </td> <td> AFF A700, FAS9000 </td> <td width="93"> 4.5P1 </td> <td width="93"> 4.5P1 </td> <td width="93"> 4.5P1 </td> <td width="93"> 4.2P3 </td> <td width="93"> 4.1P7 </td> <td width="93"> N/A </td> <td width="93"> N/A </td> <td width="93"> N/A </td> </tr> <tr> <td rowspan="2" width="110"> SP 3.x </td> <td> AFF8080, AFF8060, AFF8040, AFF8020 </td> <td width="93"> 3.7P1 </td> <td width="93"> 3.7P1 </td> <td width="93"> 3.7P1 </td> <td width="93"> 3.4P3 </td> <td width="93"> 3.3P5 </td> <td width="93"> 3.2P1 </td> <td width="93"> 3.1.2P3 </td> <td width="93"> N/A </td> </tr> <tr> <td> FAS8080, FAS8060, FAS8040, FAS8020 </td> <td width="93"> 3.7P1 </td> <td width="93"> 3.7P1 </td> <td width="93"> 3.7P1 </td> <td width="93"> 3.4P3 </td> <td width="93"> 3.3P5 </td> <td width="93"> 3.2P1 </td> <td width="93"> 3.1.2P3 </td> <td width="93"> 3.0.4P1* </td> </tr> <tr> <td rowspan="2" width="110"> SP 2.x </td> <td> FAS2554, FAS2552, FAS2520  (ONTAP 8.2.2 and later) </td> <td width="93"> 2.8P1 </td> <td width="93"> 2.8P1 </td> <td width="93"> 2.8P1 </td> <td width="93"> 2.5P1 </td> <td width="93"> 2.4.1P2 </td> <td width="93"> 2.4P1 </td> <td width="93"> 2.3.2P4 </td> <td width="93"> 2.2.5P1 </td> </tr> <tr> <td> FAS2240-4, FAS2240-2, FAS2220 (ONTAP 9.1 is the last supported release) </td> <td width="93"> N/A </td> <td width="93"> N/A </td> <td width="93"> N/A </td> <td width="93"> N/A </td> <td width="93"> 2.4.1P2 </td> <td width="93"> 2.4P1 </td> <td width="93"> 2.3.2P4 </td> <td width="93"> 2.2.5P1 </td> </tr> </tbody> </table>   N/A = "Not Applicable" (i.e. no fix required) <a href="https://kb.netapp.com/app/answers/answer_view/a_id/1087275">MD5 checksums for Service Processor Security Patch Files</a> Unaffected platforms/firmware versions: The FAS/AFF Baseboard Management Controller (BMC) , Service Processor 1.x firmware versions, ONTAP Select and Cloud Volumes ONTAP are not affected by this vulnerability – this includes the following platforms: AFF A220, FAS2720, FAS2750, AFF A800, AFF A700s, FAS6290, FAS6280, FAS6250, FAS6240, FAS6220, FAS6210, FAS3270, FAS3250, FAS3240, FAS3220, FAS3210 and V-Series variants  *Although NetApp has found no evidence of exposure in the 3.0.x Service Processor firmware, a patch has been made available out of an abundance of caution. Once patched Service Processor firmware has been applied to a controller there is no need to update ONTAP.   While the Service Processor firmware update requires a reboot of the Service Processor, the process is non-disruptive to ONTAP.  Certain versions of clustered Data ONTAP and Data ONTAP operating in 7-Mode included affected versions of the Service Processor firmware. P-releases that include the patched Service Processor firmware are available for ONTAP 9.x versions under Full Support. There are no plans to create a Data ONTAP operating in 7-Mode 8.2.5 P-release that includes the patched Service Processor firmware - use the appropriate Service Processor patch from the System Firmware + Diagnostics Download page for this version. </body> </html>

Affected products

Clustered Data ONTAP
Data ONTAP operating in 7-Mode
Service Processor

Official fixes

Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Clustered Data ONTAP — vendor fix ↗
Service Processor — vendor fix ↗

References

https://mysupport.netapp.com/NOW/download/tools/serviceimage/support/ServiceProcessorSupportMatrix.s ↗

What to do

Check the affected products listed above against the official advisory's affected-versions table — that is where the exact ONTAP 9 release, ONTAP tool, or management product versions are named.
If affected and a fixed release exists, plan the upgrade — see the ONTAP upgrade runbook.
If exploitation is listed as "active", treat remediation as urgent and review exposure (management LIFs, ONTAP S3, SnapMirror endpoints).
Harden in parallel: security hardening baseline and ransomware protection on ONTAP.