CVE-2016-6599

{"id": "CVE-2016-6599", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": true, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-01-30T20:29:00.397", "references": [{"url": "http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2018/Jan/92", "tags": ["Exploit", "Mailing List", "Technical Description", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txt", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-255"}]}], "descriptions": [{"lang": "en", "value": "BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV (\"NumaraIT\") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments."}, {"lang": "es", "value": "BMC Track-It! en versiones 11.4 anteriores a Hotfix 3 expone un servicio de configuraci\u00f3n en remoto .NET no autenticado (ConfigurationService) en el puerto 9010. El servicio contiene un m\u00e9todo que puede ser empleado para recuperar un archivo de configuraci\u00f3n que contiene el nombre de la base de datos de la aplicaci\u00f3n, el nombre de usuario y las contrase\u00f1as, as\u00ed como el nombre de usuario y la contrase\u00f1a del administrador del dominio. Estos se cifran con una clave fija e IV (\"NumaraIT\") mediante el algoritmo DES. El nombre de usuario y contrase\u00f1a del administrador del dominio solo pueden ser obtenidos si el componente Self-Service est\u00e1 habilitado, lo que es el escenario m\u00e1s com\u00fan en la implementaci\u00f3n en empresa."}], "lastModified": "2018-02-26T20:05:30.357", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bmc:track-it\\!:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27364D6B-C6B8-40EA-B1F4-849C2EB54962", "versionEndIncluding": "11.4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:bmc:track-it\\!:11.4:hf1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F28C98AB-61E2-4C92-BEAF-ECF12ACB6879"}, {"criteria": "cpe:2.3:a:bmc:track-it\\!:11.4:hf2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63548FEB-797C-4033-90B9-5FFE602E011B"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}