CVE-2016-6599: Critical severity bmc track-it! vulnerability
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6599?
The severity of CVE-2016-6599 is 9.8 (critical).
What software versions are affected by CVE-2016-6599?
BMC Track-It! 11.4 (up to Hotfix 2) and 11.4-HF1 and 11.4-HF2 are affected by CVE-2016-6599.
How can an attacker exploit CVE-2016-6599?
An attacker can exploit CVE-2016-6599 by accessing the unauthenticated .NET remoting configuration service on port 9010 and retrieving the configuration file containing sensitive database information.
Is there a fix available for CVE-2016-6599?
Yes, a hotfix is available for BMC Track-It! 11.4 to address CVE-2016-6599.
Where can I find more information about CVE-2016-6599?
You can find more information about CVE-2016-6599 at the following references: [1] [2] [3].