CVE-2024-1605 - OpenCVE

BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://cert.pl/en/posts/2024/03/CVE-2024-1604
https://cert.pl/posts/2024/03/CVE-2024-1604
https://www.bmc.com/it-solutions/control-m.html

History

No history.

MITRE

Status: PUBLISHED

Assigner: CERT-PL

Published: 2024-03-18T09:59:49.339Z

Updated: 2024-08-01T18:48:20.649Z

Reserved: 2024-02-18T21:40:58.792Z

Link: CVE-2024-1605

Vulnrichment

Updated: 2024-08-01T18:48:20.649Z

NVD

Status : Awaiting Analysis

Published: 2024-03-18T10:15:20.583

Modified: 2024-03-18T12:38:25.490

Link: CVE-2024-1605

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1605", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "state": "PUBLISHED", "assignerShortName": "CERT-PL", "dateReserved": "2024-02-18T21:40:58.792Z", "datePublished": "2024-03-18T09:59:49.339Z", "dateUpdated": "2024-08-01T18:48:20.649Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "Control-M", "vendor": "BMC", "versions": [{"lessThan": "9.0.20.238", "status": "affected", "version": "9.0.20", "versionType": "custom"}, {"lessThan": "9.0.21.201", "status": "affected", "version": "9.0.21", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Maksymilian Kubiak [Afine Team]"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Dawid Ma\u0142ecki [Afine Team]"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<div>BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. <br></div><div><br></div><div>Fix for 9.0.20 branch was released in version 9.0.20.238. <span style=\"background-color: rgb(255, 255, 255);\">Fix for 9.0.21 branch was released in version 9.0.21.201. </span><br></div>"}], "value": "BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. \n\nFix for 9.0.20 branch was released in version 9.0.20.238.\u00a0Fix for 9.0.21 branch was released in version 9.0.21.201. \n\n"}], "impacts": [{"capecId": "CAPEC-641", "descriptions": [{"lang": "en", "value": "CAPEC-641 DLL Side-Loading"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-03-18T09:59:49.339Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://cert.pl/posts/2024/03/CVE-2024-1604"}, {"tags": ["third-party-advisory"], "url": "https://cert.pl/en/posts/2024/03/CVE-2024-1604"}, {"tags": ["product"], "url": "https://www.bmc.com/it-solutions/control-m.html"}], "source": {"discovery": "UNKNOWN"}, "title": "DLL side-loading in BMC Control-M", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-19T14:18:59.843573Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T18:01:06.159Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:20.649Z"}, "title": "CVE Program Container", "references": [{"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/posts/2024/03/CVE-2024-1604"}, {"tags": ["third-party-advisory", "x_transferred"], "url": "https://cert.pl/en/posts/2024/03/CVE-2024-1604"}, {"tags": ["product", "x_transferred"], "url": "https://www.bmc.com/it-solutions/control-m.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://cert.pl/posts/2024/03/CVE-2024-1604", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://cert.pl/en/posts/2024/03/CVE-2024-1604", "tags": ["third-party-advisory", "x_transferred"]}, {"url": "https://www.bmc.com/it-solutions/control-m.html", "tags": ["product", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:48:20.649Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1605", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-03-19T14:18:59.843573Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:18.614Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "DLL side-loading in BMC Control-M", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Maksymilian Kubiak [Afine Team]"}, {"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Dawid Ma\u0142ecki [Afine Team]"}], "impacts": [{"capecId": "CAPEC-641", "descriptions": [{"lang": "en", "value": "CAPEC-641 DLL Side-Loading"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BMC", "product": "Control-M", "versions": [{"status": "affected", "version": "9.0.20", "lessThan": "9.0.20.238", "versionType": "custom"}, {"status": "affected", "version": "9.0.21", "lessThan": "9.0.21.201", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert.pl/posts/2024/03/CVE-2024-1604", "tags": ["third-party-advisory"]}, {"url": "https://cert.pl/en/posts/2024/03/CVE-2024-1604", "tags": ["third-party-advisory"]}, {"url": "https://www.bmc.com/it-solutions/control-m.html", "tags": ["product"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. \n\nFix for 9.0.20 branch was released in version 9.0.20.238.\u00a0Fix for 9.0.21 branch was released in version 9.0.21.201. \n\n", "supportingMedia": [{"type": "text/html", "value": "<div>BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. <br></div><div><br></div><div>Fix for 9.0.20 branch was released in version 9.0.20.238. <span style=\"background-color: rgb(255, 255, 255);\">Fix for 9.0.21 branch was released in version 9.0.21.201. </span><br></div>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "providerMetadata": {"orgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "shortName": "CERT-PL", "dateUpdated": "2024-03-18T09:59:49.339Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1605", "state": "PUBLISHED", "dateUpdated": "2024-08-01T18:48:20.649Z", "dateReserved": "2024-02-18T21:40:58.792Z", "assignerOrgId": "4bb8329e-dd38-46c1-aafb-9bf32bcb93c6", "datePublished": "2024-03-18T09:59:49.339Z", "assignerShortName": "CERT-PL"}, "dataVersion": "5.1"}