iDRAC 6.10.00.00 Internal Server Error when logging through the GUI
Greetings
I upgraded some R640 from 6.00.30.00 to 6.10.00.00.
When clicking on the login button, Firefox does not log me in. Firefox network tab shows a POST to /sysmgmt/2015/bmc/session failing: POST https://10.64.225.178/sysmgmt/2015/bmc/session 500 Internal Server Error
only the GUI access is broken, I can ssh to the iDRAC just fine.
iDRAC copies the list of SANs of the SSL certificate into a global char gSANentries[1024] buffer without any check on whether it fits or not, so if the total length of comma-delimited SANs exceeds this it overflows into the next global variable, which is "gSessionMap" in iDRAC 6.10.00.00 and it fails later.
We will make sure to use less SANs in our SSL certificates. (for us by this calculation we should limit ourselves to 28 instead of 52 at the moment. Maybe it was a bit ambitious).
frigo_
2 Intern
•
22 Posts
669
2
Posted January 23rd, 2023 14:00
I was able to go further with the investigation
the binary is provided on https://opensource.dell.com/releases/idrac9/6.10.00.00/ and the core can be investigated (with gdb-multiarch).
iDRAC copies the list of SANs of the SSL certificate into a global char gSANentries[1024] buffer without any check on whether it fits or not, so if the total length of comma-delimited SANs exceeds this it overflows into the next global variable, which is "gSessionMap" in iDRAC 6.10.00.00 and it fails later.
We will make sure to use less SANs in our SSL certificates. (for us by this calculation we should limit ourselves to 28 instead of 52 at the moment. Maybe it was a bit ambitious).