CVE-2016-6599

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

12.31%

Published

Jan 30, 2018

Modified

Nov 20, 2024

Public PoC / Exploit (2)

All weaponized →

TrickestTrickest PoC index Exploit-DBBMC Track-It! 11.4 - Multiple Vulnerabilities

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.

Weaknesses (CWE)

CWE-255

Affected Products (3)

bmc · track-it\!vulnerable

References (8)

http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html

ExploitThird Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/Jan/92

ExploitMailing ListTechnical Description

https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015

Vendor Advisory

https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txt