PT-2018-4965 · Bmc · Bmc Track-It!

Pedro Ribeiro · Publicado 2018-01-30 · Atualizado 2018-02-26 · CVE-2016-6599

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BMC Track-It! versions prior to 11.4 Hotfix 3

Description The issue exposes an unauthenticated .NET remoting configuration service on port 9010, specifically the ConfigurationService. This service has a method that can be used to retrieve a configuration file containing sensitive information such as the application database name, username, password, and the domain administrator username and password. The sensitive information is encrypted using the DES algorithm with a fixed key and IV ("NumaraIT"). The domain administrator credentials can be obtained if the Self-Service component is enabled, a common setup in enterprise environments.

Recommendations For versions prior to 11.4 Hotfix 3, apply Hotfix 3 to resolve the issue. As a temporary workaround, consider disabling the ConfigurationService on port 9010 until the hotfix is applied. Restrict access to the ConfigurationService to minimize the risk of exploitation. Avoid using the fixed key and IV ("NumaraIT") for encryption until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2016-6599

Produtos afetados

Bmc Track-It!

Referências · 7

• 🔥 https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txt · Exploit
• 🔥 https://exploit-db.com/exploits/43883 · Exploit
• 🔥 http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html · Exploit
• 🔥 http://seclists.org/fulldisclosure/2018/Jan/92 · Exploit
• https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-6599 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-6599 · Aviso do Fabricante