CVE-2016-9638

Published: Dec 2, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

In BMC Patrol before 9.13.10.02, the binary "listguests64" is configured with the setuid bit. However, when executing it, it will look for a binary named "virsh" using the PATH environment variable. The "listguests64" program will then run "virsh" using root privileges. This allows local users to elevate their privileges to root.

Affected (1)

Products: Bmc: Patrol

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Bmc Patrol	Up to 9.13.10.01

Related CWEs

References (6)

http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol

Source: cve@mitre.org

ExploitPatchThird Party Advisory

http://www.securityfocus.com/bid/95009

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037385

Source: cve@mitre.org

http://www.nes.fr/securitylab/index.php/2016/12/02/privilege-escalation-on-bmc-patrol

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

http://www.securityfocus.com/bid/95009

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1037385

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.