PT-2009-1457 · Bmc · Bmc Patrol Agent

Published 2009-01-27 · Updated 2018-10-11 · CVE-2008-5982

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions BMC PATROL Agent versions prior to 3.7.30

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181. This occurs because the specifiers are not properly handled when writing a log message.

Recommendations For versions prior to 3.7.30, update to version 3.7.30 or later to resolve the issue. As a temporary workaround, consider restricting access to TCP port 3181 to minimize the risk of exploitation.

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

CVE-2008-5982

Affected Products

Bmc Patrol Agent

References · 8

• http://secunia.com/advisories/33049 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5982 · Security Note
• http://vupen.com/english/advisories/2008/3379 · Note
• http://securitytracker.com/id?1021361 · Note
• http://securityfocus.com/archive/1/499013/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47175 · Note
• http://zerodayinitiative.com/advisories/ZDI-08-082 · Note
• http://securityfocus.com/bid/32692 · Note