CVSS: 7.8EPSS: 6%CPEs: 1EXPL: 2CVE-2018-20735 – BMC Patrol Agent - Privilege Escalation Code Execution Execution
https://notcve.org/view.php?id=CVE-2018-20735
An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you can use a low privileged domain user to authenticate with PatrolCli and then connect to the domain controller and run commands as SYSTEM. This means any user on a domain can escalate to domain admin through PATROL Agent. • https://www.exploit-db.com/exploits/46556 https://www.securifera.com/blog/2018/12/17/bmc-patrol-agent-domain-user-to-domain-admin • CWE-287: Improper Authentication •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 1CVE-2014-2591 – BMC Patrol For AIX Insecure RPATH Use
https://notcve.org/view.php?id=CVE-2014-2591
Untrusted search path vulnerability in BMC Patrol for AIX 3.9.00 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting. Vulnerabilidad de búsqueda de ruta no confiable en BMC Patrol para AIX 3.9.00 permite a usuarios locales ganar privilegios a través de una libraría manipulada, relacionado con una configuración RPATH incorrecta. It has been identified that binaries that are executed with elevated privileges (SetGID and SetUID programs) have been compiled in manner that means they searched for libraries in insecure locations. Version 3.9.00 of BMC Patrol for AIX is affected. • http://seclists.org/fulldisclosure/2014/Apr/199 https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-2591 •
CVSS: 10.0EPSS: 30%CPEs: 14EXPL: 0CVE-2008-5982 – BMC PatrolAgent Version Logging Format String Vulnerability
https://notcve.org/view.php?id=CVE-2008-5982
Format string vulnerability in BMC PATROL Agent before 3.7.30 allows remote attackers to execute arbitrary code via format string specifiers in an invalid version number to TCP port 3181, which are not properly handled when writing a log message. Vulnerabilidad en el formato de la cadena de caracteres en BMC PATROL Agent en versiones anteriores a 3.7.30 que permite a los atacantes remotos, ejecutar arbitrariamente código a través especificadores en el formato de la cadena caracteres en un número inválido de versión para TCP puerto 3181, el cual no es propiamente manejado cuando se escribe un mensaje de log. This vulnerability allows attackers to execute arbitrary code on vulnerable installations of BMC PatrolAgent. Authentication is not required to exploit this vulnerability. The specific flaw exists due to a format string handling error during log message writing. Supplying an invalid version number containing format string tokens to a vulnerable target on TCP port 3181 triggers an exploitable format string vulnerability which can result in arbitrary code execution. • http://secunia.com/advisories/33049 http://www.securityfocus.com/archive/1/499013/100/0/threaded http://www.securityfocus.com/bid/32692 http://www.securitytracker.com/id?1021361 http://www.vupen.com/english/advisories/2008/3379 http://www.zerodayinitiative.com/advisories/ZDI-08-082 https://exchange.xforce.ibmcloud.com/vulnerabilities/47175 • CWE-134: Use of Externally-Controlled Format String •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 2CVE-1999-1460 – BMC Software Patrol 3.2.5 - Patrol SNMP Agent File Creation/Permission
https://notcve.org/view.php?id=CVE-1999-1460
BMC PATROL SNMP Agent before 3.2.07 allows local users to create arbitrary world-writeable files as root by specifying the target file as the second argument to the snmpmagt program. • https://www.exploit-db.com/exploits/19422 http://marc.info/?l=bugtraq&m=93198293132463&w=2 http://marc.info/?l=bugtraq&m=93372579004129&w=2 http://www.securityfocus.com/bid/525 •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-1999-0801
https://notcve.org/view.php?id=CVE-1999-0801
BMC Patrol allows remote attackers to gain access to an agent by spoofing frames. • http://www.iss.net/security_center/static/2075.php http://www.securityfocus.com/archive/1/13204 •