CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2020-35593
https://notcve.org/view.php?id=CVE-2020-35593
05 Sep 2023 — BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host. BMC PATROL Agent hasta 20.08.00 permite la escalada de privilegios locales a través de vectores que involucran pconfig +RESTART -host. • http://web.archive.org/web/20210106175128/https://community.bmc.com/s/article/SECURITY-Patrol-Agent-Local-Privilege-Escalation-in-BMC-PATROL-Agent-CVE-2020-35593 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-34258
https://notcve.org/view.php?id=CVE-2023-34258
31 May 2023 — An issue was discovered in BMC Patrol before 22.1.00. The agent's configuration can be remotely queried. This configuration contains the Patrol account password, encrypted with a default AES key. This account can then be used to achieve remote code execution. • https://gist.github.com/gquere/045638b9959f4b3e119ea01d8d6ff856 • CWE-311: Missing Encryption of Sensitive Data •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-34257
https://notcve.org/view.php?id=CVE-2023-34257
31 May 2023 — An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). Some configuration fields related to SNMP (e.g., masterAgentName or masterAgentStartLine) result in code execution when the agent is restarted. NOTE: the vendor's perspective is "These are not vulnerabilities for us as we have provided the option to implement the authentication." • https://www.errno.fr/PatrolAdvisory.html#remote-code-excution-using-patrols-pconfig •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-17043
https://notcve.org/view.php?id=CVE-2019-17043
14 Oct 2019 — An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker to elevate his/her privileges to the ones of the "patrol" user by specially crafting a shared library .so file that will be loaded during execution. Se detectó un problema en BMC Patrol Agent versión 9.0.10i. Los permisos de ejecución débiles en el binario SUID best1collect.exe podrían permitir a un atacante elevar sus privilegios a los del usuario "patrol" al diseñar e... • https://github.com/blogresponder/BMC-Patrol-Agent-local-root-privilege-escalation • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-17044
https://notcve.org/view.php?id=CVE-2019-17044
14 Oct 2019 — An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges to elevate his/her privileges to the ones of the "root" user by specially crafting a shared library .so file that will be loaded during execution. Se descubrió un problema en BMC Patrol Agent versión 9.0.10i. Los permisos de ejecución débiles en el binario SUID de PatrolAgent podrían permitir a un atacante con privilegios de "patrol" elevar sus privi... • https://docs.bmc.com/docs/PATROLAgent/11302/notification-of-action-required-by-patrol-agent-users-to-apply-the-security-patch-898411558.html • CWE-276: Incorrect Default Permissions •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-8352 – IBM Websphere Application Server - Network Deployment Untrusted Data Deserialization Remote Code Execution
https://notcve.org/view.php?id=CVE-2019-8352
20 May 2019 — By default, BMC PATROL Agent through 11.3.01 uses a static encryption key for encrypting/decrypting user credentials sent over the network to managed PATROL Agent services. If an attacker were able to capture this network traffic, they could decrypt these credentials and use them to execute code or escalate privileges on the network. Por defecto, BMC PATROL Agent hasta el 11.3.01 usa una Clave de Cifrado estática para cifrar / descifrar las credenciales de usuario enviadas a través de la red a los servicios... • https://www.exploit-db.com/exploits/46969 • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 8%CPEs: 1EXPL: 2CVE-2018-20735 – BMC Patrol Agent - Privilege Escalation Code Execution Execution
https://notcve.org/view.php?id=CVE-2018-20735
17 Jan 2019 — An issue was discovered in BMC PATROL Agent through 11.3.01. It was found that the PatrolCli application can allow for lateral movement and escalation of privilege inside a Windows Active Directory environment. It was found that by default the PatrolCli / PATROL Agent application only verifies if the password provided for the given username is correct; it does not verify the permissions of the user on the network. This means if you have PATROL Agent installed on a high value target (domain controller), you ... • https://www.exploit-db.com/exploits/46556 • CWE-287: Improper Authentication •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-13130
https://notcve.org/view.php?id=CVE-2017-13130
23 Aug 2017 — mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring. mcmnm en BMC Patrol permite que usuarios locales obtengan privilegios mediante un archivo libmcmclnx.so manipulado en el directorio de trabajo actual, ya que es setuid root y la variable RPATH comienza con la subcadena ".:". • https://github.com/itm4n/bmc-patrol-mcmnm-privesc • CWE-427: Uncontrolled Search Path Element •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2016-9638
https://notcve.org/view.php?id=CVE-2016-9638
02 Dec 2016 — In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to elevate their privileges to root. En BMC Patrol en versiones anteriores a 9.13.10.02 el binario "listguests64" está configurado con el bit setuid. • http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2014-2591 – BMC Patrol For AIX Insecure RPATH Use
https://notcve.org/view.php?id=CVE-2014-2591
14 Apr 2014 — Untrusted search path vulnerability in BMC Patrol for AIX 3.9.00 allows local users to gain privileges via a crafted library, related to an incorrect RPATH setting. Vulnerabilidad de búsqueda de ruta no confiable en BMC Patrol para AIX 3.9.00 permite a usuarios locales ganar privilegios a través de una libraría manipulada, relacionado con una configuración RPATH incorrecta. It has been identified that binaries that are executed with elevated privileges (SetGID and SetUID programs) have been compiled in mann... • http://seclists.org/fulldisclosure/2014/Apr/199 •