Skip to content
CVE PROGRAM SOURCE RECORD6.6 Medium

CVE-2024-1605

DLL side-loading in BMC Control-M

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CERT-PL

Description

BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading of a potentially malicious libraries, which will execute with the application's privileges. Fix for 9.0.20 branch was released in version 9.0.20.238. Fix for 9.0.21 branch was released in version 9.0.21.201.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

BMC Control-M

Default version status: unknown

  • 9.0.20 to < 9.0.20.238affected
  • 9.0.21 to < 9.0.21.201affected

References