CVE-2016-1542 The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sendi...
HighCVSS 7.5
EPSS 74.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bmc bladelogic server automation console | = 8.2.02 | No fix listed |
| bmc bladelogic server automation console | = 8.2.03 | No fix listed |
| bmc bladelogic server automation console | = 8.2.04 | No fix listed |
| bmc bladelogic server automation console | = 8.3.00 | No fix listed |
| bmc bladelogic server automation console | = 8.3.01 | No fix listed |
| bmc bladelogic server automation console | = 8.3.02 | No fix listed |
| bmc bladelogic server automation console | = 8.3.03 | No fix listed |
| bmc bladelogic server automation console | = 8.5.00 | No fix listed |
| bmc bladelogic server automation console | = 8.5.01 | No fix listed |
| bmc bladelogic server automation console | = 8.6.00 | No fix listed |
| bmc bladelogic server automation console | = 8.7.00 | No fix listed |
References
- packetstormsecurity.com
- 20160328 BMC-2015-0010: User enumeration vulnerability in BMC Server Automation (BSA) Unix/Linux RSCD Agent (CVE-2016-1542) mailing-list
- selfservice.bmc.com patch vendor-advisory
- 43902 exploit
- 43939 exploit
- www.insinuator.net