BMC Control-M/Agent Memory Corruption Vulnerability in SSL/TLS Communication

A memory corruption vulnerability has been identified in BMC Control-M/Agent versions 9.0.22 and lower, for both UNIX and Windows. This vulnerability can be remotely triggered when SSL/TLS communication is enabled, under specific non-default configuration settings.

Impact

Exploitation of this vulnerability leads to memory corruption, which can potentially be exploited to execute arbitrary code or cause a denial-of-service condition.

Remediation

For Control-M/Agents 9.0.21 and 9.0.22, ensure the 'JAVA_AR' parameter is set to 'Y' and recycle the agent to apply the change. For Control-M/Agents 9.0.20 and lower, upgrade to a supported version and check that 'use_openssl' is set to 'Y'.