Apple released Xserve Lights-Out Management Firmware Update 1.0

Apple's Xserve Lights-Out Management Firmware Update 1.0 can be downloaded from this Apple Web page. According to Apple,

This update includes changes to the Lights-Out Management environment of the Intel-based Xserve. It addresses a security issue as well as provides enhanced reliability to the monitoring and management features of Xserve. This update is strongly recommended for all Intel-based Xserve systems.

The Xserve Lights-Out Management Firmware Update 1.0 application will be installed into the /Applications/Server folder of the selected volume. You must then run the firmware update application to perform the update to the Xserve. You may run the update as an application in the Finder of the target Xserve or remotely from the command line.

The security issue fixed is:

Xserve Lights-Out Management Firmware--CVE-2007-2387--A security vulnerability in Apple's implementation of IPMI may allow an unprivileged ipmitool user to gain administrative privileges on an Xserve system. This update addresses the issue by requiring a password for remote usage of IPMI. This issue only affects Intel-based Xserve systems. Credit to James Wilson of LithiumCorp for reporting this issue.

We don't have an Intel-based Xserve to test this update for you. [Bill Fox]