CVE-2023-34257: Critical severity BMC PATROL Agent vulnerability
DISPUTED An issue was discovered in BMC Patrol through 23.1.00. The agent's configuration can be remotely modified (and, by default, authentication is not required). Some configuration fields related to SNMP (e.g., masterAgentName or masterAgentStartLine) result in code execution when the agent is restarted. NOTE: the vendor's perspective is "These are not vulnerabilities for us as we have provided the option to implement the authentication."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure masterAgentName and masterAgentStartLine are not set to values that can trigger code execution; review and correct SNMP-related configuration so that restarting the agent does not process attacker-influenced fields.
BMC Patrol (SNMP agent configuration) masterAgentName / masterAgentStartLine = Remove/avoid using these SNMP configuration fields (use safe values or do not set them) - Configuration
Enable the option to require authentication for remote modification of the agent configuration (vendor note: “provided the option to implement the authentication”).
BMC Patrol authentication requirement for remote configuration modification = Enable - Compensating control
Restrict network access to the mechanism that allows remote modification of the BMC Patrol agent configuration (since the configuration can be remotely modified and, by default, authentication is not required).
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-34257.
What is the severity of CVE-2023-34257?
The severity of CVE-2023-34257 is critical with a severity value of 9.8.
What is the affected software?
The affected software is BMC PATROL Agent version 23.1.00.
Is authentication required to modify the agent's configuration?
By default, authentication is not required to modify the agent's configuration.
How can this vulnerability be exploited?
This vulnerability can be exploited by remotely modifying the agent's configuration, particularly in fields related to SNMP, resulting in code execution.