PT-2007-3317 · Bmc · Bmc Performance Manager

Published 2007-04-22 · Updated 2024-08-07 · CVE-2007-1972

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions BMC Performance Manager (affected versions not specified)

Description The issue concerns a lack of authentication requirement for requests to modify configuration files. This could potentially allow remote attackers to execute arbitrary code by sending a request on TCP port 3181 to modify specific SNMP parameters, such as masterAgentName and masterAgentStartLine. However, the vendor disputes the existence of this issue, stating it does not occur when the system is properly configured.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-1972

Affected Products

Bmc Performance Manager

References · 8

• http://zerodayinitiative.com/advisories/ZDI-07-020.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-1972 · Security Note
• http://securityfocus.com/archive/1/466223/100/0/threaded · Note
• http://securityfocus.com/bid/23559 · Note
• http://securityreason.com/securityalert/2599 · Note
• http://vupen.com/english/advisories/2007/1458 · Note
• http://securityfocus.com/archive/1/466274/100/0/threaded · Note
• http://securitytracker.com/id?1017935 · Note