PT-2011-2783 · Bmc · Performance Assurance For Virtual Servers+4
Manuel Santamarina-Suarez
·
Published
2011-02-10
·
Updated
2018-10-09
·
CVE-2011-0975
CVSS v2.0
10
High
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
BMC PATROL Agent Service Daemon for Performance Analysis for Servers versions 7.4.00 through 7.5.10
Performance Assurance for Servers versions 7.4.00 through 7.5.10
Performance Assurance for Virtual Servers versions 7.4.00 through 7.5.10
Performance Analyzer and Performance Predictor for Servers versions 7.4.00 through 7.5.10
Capacity Management Essentials version 1.2.00 (7.4.15)
Description
The issue allows remote attackers to execute arbitrary code via a crafted length value in a BGS MULTIPLE READS command to TCP port 6768. This is a result of a stack-based buffer overflow.
Recommendations
For BMC PATROL Agent Service Daemon for Performance Analysis for Servers versions 7.4.00 through 7.5.10, update to a version outside of this range.
For Performance Assurance for Servers versions 7.4.00 through 7.5.10, update to a version outside of this range.
For Performance Assurance for Virtual Servers versions 7.4.00 through 7.5.10, update to a version outside of this range.
For Performance Analyzer and Performance Predictor for Servers versions 7.4.00 through 7.5.10, update to a version outside of this range.
For Capacity Management Essentials version 1.2.00 (7.4.15), update to a version outside of this range.
As a temporary workaround, consider restricting access to TCP port 6768 to minimize the risk of exploitation.
Fix
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bmc Patrol Agent Service Daemon For Performance Analysis For Servers
Capacity Management Essentials
Performance Analyzer/Performance Predictor For Servers
Performance Assurance For Servers
Performance Assurance For Virtual Servers