CVE-2024-1605: DLL side-loading in BMC Control-M
BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges.
Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1605?
CVE-2024-1605 is classified as a high severity vulnerability due to its potential for exploitation through unauthorized execution of malicious DLLs.
How do I fix CVE-2024-1605?
To remediate CVE-2024-1605, restrict the permissions of the DLL directory to prevent write access by all users.
What versions of BMC Control-M are affected by CVE-2024-1605?
CVE-2024-1605 affects BMC Control-M versions 9.0.20 and 9.0.21.
What type of exploitation is possible with CVE-2024-1605?
CVE-2024-1605 can be exploited to load and execute malicious Dynamic Link Libraries during user login.
Is there a patch available for CVE-2024-1605?
As of now, users should check with BMC for any available patches or updates addressing CVE-2024-1605.