CVE-2023-34257
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk59th percentile - higher than 59% of all known CVEs
Summary
An issue was discovered in BMC Patrol through version 23.1.00 that allows remote modification of the agent's configuration without authentication. Some SNMP-related configuration fields can lead to code execution when the agent is restarted.
Risk Assessment
The lack of authentication poses a risk of unauthorized configuration changes, potentially leading to the execution of malicious code on the system.
Recommendation
It is recommended to implement authentication for the agent's configuration and to monitor and secure access to the system.
Other vulnerabilities in BMC Patrol
See all- CVE-2017-13130High
mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring.
- CVE-2016-9638High
In BMC Patrol before version 9.13.10.02, the binary 'listguests64' is configured with the setuid bit. When executed, it looks for a binary named 'virsh' using the PATH environment variable, allowing it to run 'virsh' with root privileges.
- CVE-2023-34258High
An issue was discovered in BMC Patrol before version 22.1.00 that allows the agent's configuration to be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key, which can lead to remote code execution.
- CVE-1999-0801High
BMC Patrol allows remote attackers to gain access to an agent by spoofing frames.
- CVE-1999-0921Medium
BMC Patrol allows any remote attacker to flood its UDP port, causing a denial of service.
Original NVD description (English source)
An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). Some configuration fields related to SNMP (e.g., masterAgentName or masterAgentStartLine) result in code execution when the agent is restarted. NOTE: the vendor's perspective is "These are not vulnerabilities for us as we have provided the option to implement the authentication."