Hardware Management Console Readme

PTF MH01639

Known Issues

1. Special Install Instructions: Installing this PTF using the Enhanced+ interface may hang.  Prior to installing this PTF using the web browser graphical interface perform the following:

1.    Log in again selecting the Log In option of "Classic".
2.    If already logged in to the HMC using Enhanced GUI, log off the HMC.
3.    Install using the normal installation instructions.

Alternatively, Install this PTF using the CLI updhmc command

2. After installing this PTF, the security mode cannot be changed. The chhmc -c security -s modify --mode nist_sp800_131a command will fail with "Invalid Parameter".

3. After installing this PTF and rebooting, if a Save Upgrade Data is run and no upgrade is done after and later a reboot is performed, the REST API functions will no longer be available.  This impacts Enhanced GUI login, Power Enterprise Pools, PowerVC, PCM and any other function that utilizes the REST API on the HMC.  For additional details and information please see http://www-01.ibm.com/support/docview.wss?uid=nas8N1021472
Workaround:  Only run Save Upgrade Data immediately prior to an upgrade to a new release of HMC.

Command line changes

This PTF adds a new option to the chhmc command to allow an admin to set a grub password at bootup.  To resolve this security vulnerability, users apply the PTF (with mandatory reboot) then set a password.

Syntax:
chhmc -c grubpasswd
                  -s {enable | disable | modify}
                  [--passwd password]

• To enable and set the password
  chhmc -c grubpasswd -s enable --passwd password
  
  
• To disable the grub password
  chhmc -c grubpasswd -s  disable
  
  
• To modify the grub password
  chmc -c grubpasswd -s  modify --passwd password 

List of fixes

Security Fixes

• Added functionality to the chhmc command to allow an admin to set a grub password at bootup.
  
• Fixed openSSL vulnerabilities:  CVE-2016-2105, CVE-2016-2106, CVE-2016-2107, CVE-2016-2108, and CVE-2016-2109
• Fixed security scan vulnerability by enabling TLSv1.2 by default for HMC vterm port (9960) when HMC is in Legacy mode.
  
• Fixed Java vulnerability: CVE-2016-3426.
• Fixed an issue where a user was unable to connect to enhanced GUI in NIST mode because of the following cipher in cipher list: TLS_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
• Fixed Power Hardware Management Console: CVE-2016-0230

General Fixes

• Fixed an issue where backing up the HMC included PCM data even though the user did not select to include PCM data.
  
• Fixed an issue where the Console Window > Open Terminal Window task may fail with "javax.net.ssl.SSLProtocolException: handshake alert: unrecognized_name" in Java console output.
  
• Fixed an issue where a newly added usb device did not get an entry in the /etc/fstab table impacting lshw calls.
  
• Fixed an issue where the call home from the Manage Dumps panel was uploading incomplete data.
  
• Disabled  keyboard shortcut feature for all GUI panels.
  
• Fixed an error seen after restoring a critical console data backup, error after login is "Not Found. The application or context root for this request has not been found:/rest/ui/static/RedirectCCFWLogon".
  
• Fixed a chatlet exception to prevent call home SRC E3550046.
  
• Added a fix to check for potential X configuration failures and to subsequently reset display configs to defaults in order to avoid "out of range" failures.
  
• Fixed an issue with the TF4 display which extended outside of the viewable pane.
  
• Fixed an issue with dynamically removing adapters that may result in error "Error Rendering Task Panel. An unrecoverable error has occurred while rendering a task's graphical output.  An attempt has been made to terminate the task.  Any operation in progress may have been interrupted prematurely.  An entry in the error log has been created so this problem can be reported automatically."
  
• Fixed an issue to prevent call home of SRCs E355104B and E355104D.
  
• Fixed an issue with chhmc where adding a nameserver failed silently.
  
  

Additional information

Back to top