CVE-2016-6599
First published: Tue Jan 30 2018(Updated: )
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Bmc Track-it\! | <=11.4 | |
| Bmc Track-it\! | =11.4-hf1 | |
| Bmc Track-it\! | =11.4-hf2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html
- http://seclists.org/fulldisclosure/2018/Jan/92
- https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015
- https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txt
Frequently Asked Questions
What is the severity of CVE-2016-6599?
The severity of CVE-2016-6599 is 9.8 (critical).
What software versions are affected by CVE-2016-6599?
BMC Track-It! 11.4 (up to Hotfix 2) and 11.4-HF1 and 11.4-HF2 are affected by CVE-2016-6599.
How can an attacker exploit CVE-2016-6599?
An attacker can exploit CVE-2016-6599 by accessing the unauthenticated .NET remoting configuration service on port 9010 and retrieving the configuration file containing sensitive database information.
Is there a fix available for CVE-2016-6599?
Yes, a hotfix is available for BMC Track-It! 11.4 to address CVE-2016-6599.
Where can I find more information about CVE-2016-6599?
You can find more information about CVE-2016-6599 at the following references: [1] [2] [3].
- collector/nvd-index
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/severity
- agent/references
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/bmc
- canonical/bmc track-it\!
- version/bmc track-it\!/11.4
- version/bmc track-it\!/11.4-hf1
- version/bmc track-it\!/11.4-hf2