CVE-2019-17043: 
BMC Patrol Agent vulnerability analysis and mitigation

An issue was discovered in BMC Patrol Agent 9.0.10i, identified as CVE-2019-17043. The vulnerability involves weak execution permissions on the best1collect.exe SUID binary, which could allow an attacker to elevate their privileges to those of the "patrol" user by crafting a specially designed shared library .so file that will be loaded during execution. The vulnerability was discovered on July 3, 2019, and was publicly disclosed on September 14, 2019 (GitHub POC).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is categorized under CWE-276 (Incorrect Default Permissions). The vulnerability specifically targets the best1collect.exe SUID binary's execution permissions, allowing for privilege escalation through the loading of a crafted shared library (NVD).

The vulnerability allows an attacker to elevate their privileges to the level of the "patrol" user. This represents the first step in a potential two-stage privilege escalation chain, as when combined with CVE-2019-17044, it could allow complete elevation from any user to root privileges (GitHub POC).

A proof-of-concept exploit has been publicly released demonstrating the vulnerability. The exploit requires local access to the system and involves crafting a specific shared library .so file that is loaded during the execution of the best1collect.exe SUID binary (GitHub POC).

According to BMC, this vulnerability has been tested and is not manifesting in the currently supported versions of Patrol Agent. Organizations using BMC Patrol Agent should ensure they are running a supported version of the software (GitHub POC).

The vulnerability was discovered by Jan Kopec and Charles d'Hondt, security researchers at LEXFO. The discovery and responsible disclosure process involved initial contact with the vendor on July 7, 2019, with the vendor responding and initiating the vulnerability reviewing process the following day (GitHub POC).