CVE-2016-1543 The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user...
HighCVSS 7.5
EPSS 71.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bmc bladelogic server automation console | = 8.2.02 | No fix listed |
| bmc bladelogic server automation console | = 8.2.03 | No fix listed |
| bmc bladelogic server automation console | = 8.2.04 | No fix listed |
| bmc bladelogic server automation console | = 8.3.00 | No fix listed |
| bmc bladelogic server automation console | = 8.3.01 | No fix listed |
| bmc bladelogic server automation console | = 8.3.02 | No fix listed |
| bmc bladelogic server automation console | = 8.3.03 | No fix listed |
| bmc bladelogic server automation console | = 8.5.00 | No fix listed |
| bmc bladelogic server automation console | = 8.5.01 | No fix listed |
| bmc bladelogic server automation console | = 8.6.00 | No fix listed |
| bmc bladelogic server automation console | = 8.7.00 | No fix listed |
References
- packetstormsecurity.com
- 20160328 BMC-2015-0011: Unauthorized password reset vulnerability in BMC Server Automation (BSA) (CVE-2016-1543) mailing-list
- selfservice.bmc.com patch vendor-advisory
- 43902 exploit
- 43939 exploit
- www.insinuator.net