CVE-2016-6599 Information disclosure in n/a
Unauthenticated attackers can retrieve encrypted database and domain administrator credentials from the configuration service, leading to potential system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6599?
CVE-2016-6599 is a critical vulnerability in n/a, published on 30 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
Weakness: CWE-255
Which versions are affected by CVE-2016-6599?
It affects 1 product.
Products include Bmc Track-It\!.
How do I fix CVE-2016-6599?
No fix has been published for CVE-2016-6599 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-6599 being exploited?
There is no known exploitation of CVE-2016-6599 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-8jf3-x896-4634.