CVE-2016-1543

EPSS 71.9%

The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.

Produtos afetados

n/a · n/a

PoCs públicas encontradas — 5

cve_referencepacketstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.htmlnão verificado cve_referencewww.exploit-db.com/exploits/43902/não verificado cve_referencewww.exploit-db.com/exploits/43939/não verificado exploitdbwww.exploit-db.com/exploits/43902não verificado exploitdbwww.exploit-db.com/exploits/43939não verificado

⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

http://packetstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.html https://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solution https://www.exploit-db.com/exploits/43902/https://www.exploit-db.com/exploits/43939/https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/http://www.securityfocus.com/archive/1/537910/100/0/threaded