CVE-2016-1542
62Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 75%
from disclosure to weapon318 days
Published on NVDJun 13
1st PoC+318d
metasploitMar 16
exploitation probability
75%top 1% of all CVEs
observed exploitation
nono source reports it
7 public exploit(s)
The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.
Affected products
n/a · n/apublic PoCs found — 7✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/43939exploitdbwww.exploit-db.com/exploits/43902unverifiedgithubgithub.com/bao7uo/bmc_bladelogic★ 20githubgithub.com/patriknordlen/bladelogic_bmc-cve-2016-1542★ 0cve_referencewww.exploit-db.com/exploits/43902/unverifiedcve_referencewww.exploit-db.com/exploits/43939/unverifiedcve_referencepacketstormsecurity.com/files/136461/BMC-Server-Automation-BSA-RSCD-Agent-User-Enumeration.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/136461/BMC-Server-Automation-BSA-RSCD-Agent-User-Enumeration.htmlhttps://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solutionhttps://www.exploit-db.com/exploits/43902/https://www.exploit-db.com/exploits/43939/https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/http://www.securityfocus.com/archive/1/537909/100/0/threaded