7.8

CVE-2019-17044

EPSS 0.05%
Veröffentlicht 14.10.2019 17:15:09
Zuletzt bearbeitet 21.11.2024 04:31:35
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges to elevate his/her privileges to the ones of the "root" user by specially crafting a shared library .so file that will be loaded during execution.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Bmc ≫ Patrol Agent Version9.0.10i

Linux ≫ Linux Kernel Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.05%	0.16

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.2	3.9	10	AV:L/AC:L/Au:N/C:C/I:C/A:C

CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://github.com/blogresponder/BMC-Patrol-Agent-local-root-privilege-escalation

Third Party Advisory

https://twitter.com/whira_wr

Third Party Advisory

https://docs.bmc.com/docs/PATROLAgent/11302/notification-of-action-required-by-patrol-agent-users-to-apply-the-security-patch-898411558.html

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-17044

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-17044

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-17044

EUVD