Multiple BMC Products are prone to an overflow condition. The BMC Patrol Agent service fails to properly sanitize user-supplied input when processing certain 'BGS_MULTIPLE_READS' commands resulting in a stack-based buffer overflow. With a specially crafted request to TCP port 6768, a remote attacker can potentially execute arbitrary code.

Currently, there are no known workarounds or upgrades to correct this issue. However, BMC has released a patch to address this vulnerability.

• CVE ID: 2011-0975 (see also: NVD)
• Secunia Advisory ID: 43177
• Bugtraq ID: 46151
• ISS X-Force ID: 65135
• VUPEN Advisory: ADV-2011-0286
• Mail List Post: http://seclists.org/bugtraq/2011/Feb/32
• Other Advisory URL: http://www.zerodayinitiative.com/advisories/ZDI-11-039/

• Manuel Santamarina-Suarez - Zero Day Initiative (ZDI)