PT-2020-10095 · Bmc · Bmc Control-M/Agent

Published 2020-04-30 · Updated 2020-05-26 · CVE-2019-19215

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Control-M/Agent version 7.0.00.000

Description A buffer overflow issue exists when the On-Do action destination is set to Mail and the Control-M/Agent is configured to send emails. This allows remote attackers to have an unspecified impact via vectors related to the configured IP address or SMTP server.

Recommendations For BMC Control-M/Agent version 7.0.00.000, consider disabling the email sending functionality when the On-Do action destination is set to Mail as a temporary workaround until a patch is available. Restrict access to the configured IP address or SMTP server to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2019-19215

Affected Products

Bmc Control-M/Agent

References · 5

• https://osv.dev/vulnerability/CVE-2019-19215 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19215 · Security Note
• https://bmc.com/it-solutions/control-m.html · Note
• https://t.me/cvenotify/3440 · Telegram Post
• https://herolab.usd.de/en/security-advisories · Note