{"id":16645,"date":"2021-07-07T15:40:15","date_gmt":"2021-07-07T13:40:15","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2019-0066\/"},"modified":"2021-07-19T14:13:27","modified_gmt":"2021-07-19T12:13:27","slug":"usd-2019-0066","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2019-0066\/","title":{"rendered":"usd-2019-0066"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n<h1 class=\"h-custom-headline usd-small-letters h2\"><span>usd-2019-0066 | Control-M\/Agent<\/span><\/h1>\n<p><span><\/span><br \/><strong>Advisory ID<\/strong><span>: usd-2019-0066<\/span><br \/><strong>CVE Number<\/strong><span>: CVE-2019-19218<\/span><br \/><strong>Affected Product<\/strong><span>: Control-M\/Agent<\/span><br \/><strong>Affected Version<\/strong><span>: 7.0.00.000 <\/span><br \/><strong>Vulnerability Type<\/strong><span>: Insecure Password Storage<\/span><br \/><strong>Security Risk<\/strong><span>: Conditional*<\/span><br \/><strong>Vendor URL<\/strong><span>: <a href=\"https:\/\/www.bmcsoftware.de\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.bmcsoftware.de\/<\/a><\/span><br \/><strong>Vendor Status<\/strong><span>: Fixed (according to vendor)<\/span><\/p>\n<p><span>* We consider the vulnerability to be of conditional severity as the vendor explicitly recommends to use TLS and the attacks only work when TLS is disabled. Nevertheless, as we encountered real-life configurations without TLS, we would like to highlight the increased criticality in case of a customer misconfiguration.<\/span><\/p>\n<p>&nbsp;<\/p>\n<h3>Description<\/h3>\n<p><span>An Insecure Password Storage vulnerability was found in the communication between Control-M\/Agent and Control-M\/Server when using the TCP protocol and handling output with an unsupported action.<\/span><\/p>\n<p><span><\/span><\/p>\n<div class=\"e16902-22 x-container max width\">\n<div class=\"e16902-23 x-column x-sm x-1-1\">\n<h3>Fix<\/h3>\n<p><span>Apply more restrictive file permissions to files that store sensitive information.<\/span><\/p>\n<h3><\/h3>\n<h3>Timeline<\/h3>\n<ul>\n<li>2019-10-29 Initial contact with <a href=\"mailto:appsec@bmc.com\">appsec@bmc.com<\/a><\/li>\n<li>2019-10-29 Submit additional findings to<a href=\"mailto:appsec@bmc.com\"> appsec@bmc.com<\/a><\/li>\n<li>2019-12-17 Agreement on Coordinated Disclosure: Vendor schedules fix for 10th February 2020<\/li>\n<li>2020-03-26 Vendor agrees to disclose advisories<\/li>\n<li>2020-04-29 <span>Security advisory released<\/span><\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Credits<\/h3>\n<p><span>This security vulnerability was found by Tobias Neitzel of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n<p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"][\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2019-0066 | Control-M\/Agent Advisory ID: usd-2019-0066CVE Number: CVE-2019-19218Affected Product: Control-M\/AgentAffected Version: 7.0.00.000 Vulnerability Type: Insecure Password StorageSecurity Risk: Conditional*Vendor URL: https:\/\/www.bmcsoftware.de\/Vendor Status: Fixed (according to vendor) * We consider the vulnerability to be of conditional severity as the vendor explicitly recommends to use TLS and the attacks only work when TLS is disabled. Nevertheless, as [&hellip;]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16645","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16645","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16645"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16645\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16645"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}