CVE-2016-6599 BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a con...
CriticalCVSS 9.8
EPSS 12.3%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| bmc track-it | <= 11.4 | No fix listed |
| bmc track-it | = 11.4-hf1 | No fix listed |
| bmc track-it | = 11.4-hf2 | No fix listed |
References
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20180126 [CVE-2016-6598/9]: RCE and admin cred disclosure in BMC Track-It! 11.4 exploit mailing-list technical-description third-party-advisory
- communities.bmc.com vendor-advisory
- github.com exploit third-party-advisory