CVE-2016-9638
HighSummary
In BMC Patrol before version 9.13.10.02, the binary 'listguests64' is configured with the setuid bit. When executed, it looks for a binary named 'virsh' using the PATH environment variable, allowing it to run 'virsh' with root privileges.
Risk Assessment
Local users can elevate their privileges to root, posing a significant security risk to the system.
Recommendation
It is recommended to update BMC Patrol to version 9.13.10.02 or later and consider changing the setuid configuration for 'listguests64'.
Other vulnerabilities in BMC Patrol
See all- CVE-2017-13130High
mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring.
- CVE-2023-34257Critical
An issue was discovered in BMC Patrol through version 23.1.00 that allows remote modification of the agent's configuration without authentication. Some SNMP-related configuration fields can lead to code execution when the agent is restarted.
- CVE-2023-34258High
An issue was discovered in BMC Patrol before version 22.1.00 that allows the agent's configuration to be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key, which can lead to remote code execution.
- CVE-1999-0801High
BMC Patrol allows remote attackers to gain access to an agent by spoofing frames.
- CVE-1999-0921Medium
BMC Patrol allows any remote attacker to flood its UDP port, causing a denial of service.
Original NVD description (English source)
In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to elevate their privileges to root.