CVE-2019-17044: 
BMC Patrol Agent vulnerability analysis and mitigation

An issue was discovered in BMC Patrol Agent 9.0.10i, identified as CVE-2019-17044. The vulnerability involves weak execution permissions on the PatrolAgent SUID binary that could allow privilege escalation from 'patrol' user to 'root' user privileges. The vulnerability was discovered by Jan Kopec and Charles d'Hondt from LEXFO and was disclosed on September 14, 2019 (BMC Advisory, GitHub POC).

The vulnerability stems from weak execution permissions on the PatrolAgent SUID binary. An attacker with 'patrol' privileges can exploit this by specially crafting a shared library .so file that will be loaded during execution, leading to privilege escalation. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is categorized as CWE-276 (Incorrect Default Permissions) (NVD).

The successful exploitation of this vulnerability allows an attacker with 'patrol' user privileges to elevate their privileges to root user level, effectively gaining complete control over the affected system. This could lead to unauthorized access to sensitive system resources and potential compromise of the entire system (BMC Advisory).

A proof-of-concept exploit has been publicly released demonstrating the vulnerability. The exploit requires the attacker to have 'patrol' user privileges and involves crafting a malicious shared library that is loaded by the SUID binary during execution (GitHub POC).

BMC has released a security patch to address this vulnerability. Users can apply the patch using either the TrueSight console (for TrueSight Operations Management 10.7 or later and PATROL Agent 10.7 or later) or the PATROL Installation Utility (for version 10.7 or later). The patch should be applied to all PATROL Agents running on Linux systems (BMC Advisory).