BMC Control-M/Agent Improper IP Address Filtering Vulnerability

A vulnerability exists in BMC Control-M/Agent for UNIX and Windows, specifically in versions through 9.0.20. The issue arises from an improper validation order of the AUTHORIZED_CTM_IP parameter. This parameter, not used by default, is only validated after the SSL/TLS handshake, which can expose the agent to certain vulnerabilities in the SSL/TLS implementation or potentially lead to resource exhaustion.

Impact

Exploitation of this vulnerability could allow for resource exhaustion or the introduction of vulnerabilities in the SSL/TLS implementation, under certain non-default conditions.

Remediation

Users are advised to upgrade to Control-M/Agent version 9.0.21 or 9.0.22. For those unable to upgrade immediately, it is recommended to implement network firewall rules that allow access to the Control-M/Agent's Server-to-Agent port only from authorized Control-M/Server machines.