PT-2009-1457 · Bmc · Bmc Patrol Agent

Publicado 2009-01-27 · Atualizado 2018-10-11 · CVE-2008-5982

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BMC PATROL Agent versions prior to 3.7.30

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181. This occurs because the specifiers are not properly handled when writing a log message.

Recommendations For versions prior to 3.7.30, update to version 3.7.30 or later to resolve the issue. As a temporary workaround, consider restricting access to TCP port 3181 to minimize the risk of exploitation.

Correção

Use of Externally-Controlled Format String

Enumeração de Fraquezas

CWE-134

Identificadores relacionados

CVE-2008-5982

Produtos afetados

Bmc Patrol Agent

Referências · 8

• http://secunia.com/advisories/33049 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2008-5982 · Nota de Segurança
• http://vupen.com/english/advisories/2008/3379 · Nota
• http://securitytracker.com/id?1021361 · Nota
• http://securityfocus.com/archive/1/499013/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47175 · Nota
• http://zerodayinitiative.com/advisories/ZDI-08-082 · Nota
• http://securityfocus.com/bid/32692 · Nota