K16846 : IPMI vulnerability CVE-2013-4786

Security Advisory Description

The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC. (CVE-2013-4786)
Impact
This vulnerability may allow remote attackers to obtain password hashes and conduct offline password guessing attacks.
In the default configuration, Intelligent Platform Management Interface (IPMI) protocol is disabled for external hosts on BIG-IP platforms. The following iSeries platforms are vulnerable when you configure the Always-On Management (AOM) network and enable IPMI access and configure a user. F5 recommends that you do not enable IPMI protocol on the following BIG-IP iSeries platforms:

• i5000 (C119)
• i7000 (C118)
• i10000 (C116)