{"id":16637,"date":"2021-07-07T15:44:21","date_gmt":"2021-07-07T13:44:21","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2019-0060\/"},"modified":"2021-07-19T14:12:58","modified_gmt":"2021-07-19T12:12:58","slug":"usd-2019-0060","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2019-0060\/","title":{"rendered":"usd-2019-0060"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n<h1 class=\"h-custom-headline usd-small-letters h2\"><span>usd-2019-0060 | Control-M\/Agent<\/span><\/h1>\n<p><span><\/span><br \/><strong>Advisory ID<\/strong><span>: usd-2019-0060<\/span><br \/><strong>CVE Number<\/strong><span>: CVE-2019-19216<\/span><br \/><strong>Affected Product<\/strong><span>: Control-M\/Agent<\/span><br \/><strong>Affected Version<\/strong><span>: 7.0.00.000 <\/span><br \/><strong>Vulnerability Type<\/strong><span>: Insecure File Copy<\/span><br \/><strong>Security Risk<\/strong><span>: High (conditional)*<\/span><br \/><strong>Vendor URL<\/strong><span>: <a href=\"https:\/\/www.bmcsoftware.de\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.bmcsoftware.de\/<\/a><\/span><br \/><strong>Vendor Status<\/strong><span>: Fixed (according to vendor)<\/span><\/p>\n<p><span>* We do not consider the vulnerability to be of critical severity as the vendor explicitly recommends to use TLS and the attacks only work when TLS is disabled. Nevertheless, as we encountered real-life configurations without TLS, we would like to highlight the increased criticality in case of a customer misconfiguration.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3>Description<\/h3>\n<p><span>The Control-M agent can copy log files to the user\u2019s home folder who owns the Joblog to copy. The vendor recommends to run the agent as a non-root user, this is the default configuration. Nevertheless, as we encountered real-life configurations with the agent running with root privileges, we would like to highlight that in this case root\u2019s home directory is affected, too.<\/span><br \/><span>As a result, any user with access to the Control-M\/Agent may overwrite sensitive files with privileges of the agent. If the agent is run with root privileges an remote attacker may even place chosen commands in root\u2019s .bashrc that would be executed on the next login.<\/span><\/p>\n<p><span><\/span><\/p>\n<div class=\"e16902-22 x-container max width\">\n<div class=\"e16902-23 x-column x-sm x-1-1\">\n<h3>Fix<\/h3>\n<p><span>Copying files as a high privileged users like \u201eroot\u201c based on user controlled conditions is always dangerous. At least make sure, that no files in the user\u2019s directories can be overwritten with log files performing these actions.<\/span><\/p>\n<h3><\/h3>\n<h3>Timeline<\/h3>\n<ul>\n<li>2019-10-29 Initial contact with <a href=\"mailto:appsec@bmc.com\">appsec@bmc.com<\/a><\/li>\n<li>2019-10-29 Submit additional findings to<a href=\"mailto:appsec@bmc.com\"> appsec@bmc.com<\/a><\/li>\n<li>2019-12-17 Agreement on Coordinated Disclosure: Vendor schedules fix for 10th February 2020<\/li>\n<li>2020-03-26 Vendor agrees to disclose advisories<\/li>\n<li>2020-04-29 <span>Security advisory released<\/span><span><\/span><\/li>\n<\/ul>\n<p><span><\/span><\/p>\n<h3>Credits<\/h3>\n<p><span>This security vulnerability was found by Tobias Neitzel of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n<p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"][\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2019-0060 | Control-M\/Agent Advisory ID: usd-2019-0060CVE Number: CVE-2019-19216Affected Product: Control-M\/AgentAffected Version: 7.0.00.000 Vulnerability Type: Insecure File CopySecurity Risk: High (conditional)*Vendor URL: https:\/\/www.bmcsoftware.de\/Vendor Status: Fixed (according to vendor) * We do not consider the vulnerability to be of critical severity as the vendor explicitly recommends to use TLS and the attacks only work when TLS is [&hellip;]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16637","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16637","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16637"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16637\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16637"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}