CVE:CVE-2011-0975
CNNVD:CNNVD-201102-128
基于Performance Analysis for Servers，Performance Assurance for Servers，以及Performance Assurance for Virtual Servers 7.4.00至7.5.10版本中的BMC PATROL Agent Service Daemon；Performance Analyzer和Performance Predictor for Servers 7.4.00至7.5.10版本；Capacity Management Essentials 1.2.00(7.4.15)版本中存在基于栈的缓冲区溢出漏洞。BMC Patrol Agent服务后台程序处理"BGS_MULTIPLE_READS"命令时，信任了用户提供的长度值，并在读取任意数据到栈缓冲区时加以利用。远程攻击者通过提供超大值，可利用此漏洞以系统级别执行任意代码。
solution:Upgrade bmc performance_analysis_for_servers to a higher version than 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10,and avoid the version 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10; Upgrade bmc performance_assurance_for_servers to a higher version than 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10,and avoid the version 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10; Upgrade bmc performance_assurance_for_virtual_servers to a higher version than 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10,and avoid the version 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10; Upgrade bmc performance_analyzer_for_servers to a higher version than 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10,and avoid the version 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10; Upgrade bmc performance_predictor_for_servers to a higher version than 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10,and avoid the version 7.4.00,7.4.10,7.4.15,7.5.00,7.5.10; Upgrade bmc capacity_management_essentials to a higher version than 1.2.00,and avoid the version 1.2.00