CVE-2016-9638

Опубликовано: 02 дек. 2016

Источник: nvd

CVSS3: 7.8

CVSS2: 7.2

EPSS Низкий

Описание

In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to elevate their privileges to root.

Ссылки

http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol
Exploit
Patch
Third Party Advisory
http://www.securityfocus.com/bid/95009
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037385
http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol
Exploit
Patch
Third Party Advisory
http://www.securityfocus.com/bid/95009
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1037385

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bmc:patrol:*:*:*:*:*:*:*:*

Версия до 9.13.10.01 (включая)

EPSS

Процентиль: 17%

0.00054

Низкий

7.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-g265-mq7h-8cq4