CVE-2020-11862
📋 TL;DR
This vulnerability in OpenText NetIQ Privileged Account Manager allows attackers to flood the system with requests, causing resource exhaustion and potential denial of service. It affects all NetIQ PAM installations on Linux, Windows, and 64-bit systems before version 3.7.0.2.
💻 Affected Systems
- OpenText NetIQ Privileged Account Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system unavailability due to resource exhaustion, preventing legitimate users from accessing privileged account management functions and potentially disrupting dependent systems.
Likely Case
Degraded performance or temporary service disruption affecting privileged account management operations, potentially impacting security workflows.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place, though some performance degradation may still occur during attacks.
🎯 Exploit Status
Resource flooding attacks are generally simple to execute and require minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.7.0.2
Vendor Advisory: https://www.netiq.com/documentation/privileged-account-manager-37/npam_3702_releasenotes/data/npam_3702_releasenotes.html
Restart Required: Yes
Instructions:
1. Download NetIQ PAM 3.7.0.2 from official sources. 2. Backup current configuration. 3. Apply the update following vendor documentation. 4. Restart the PAM service. 5. Verify functionality.
🔧 Temporary Workarounds
Network Rate Limiting
allImplement network-level rate limiting to restrict request frequency to PAM services
Network Segmentation
allRestrict network access to PAM systems to only trusted administrative networks
🧯 If You Can't Patch
- Implement strict network access controls and firewall rules to limit who can reach the PAM system
- Deploy network-based DDoS protection or WAF with rate limiting capabilities
🔍 How to Verify
Check if Vulnerable:
Check the installed version of NetIQ PAM via administrative console or system informationCheck Version:
Check via PAM administrative interface or consult system documentation for version query commandsVerify Fix Applied:
Verify version is 3.7.0.2 or later and test system responsiveness under load📡 Detection & Monitoring
Log Indicators:
- Unusually high request volumes
- Resource exhaustion warnings
- Performance degradation alerts
Network Indicators:
- High volume of requests from single or few sources
- Abnormal traffic patterns to PAM ports
SIEM Query:
source="pam_logs" AND (message="resource exhaustion" OR message="high load" OR message="connection flood")