Vulnerabilities > CVE-2016-5063 - Improper Authorization vulnerability in BMC Server Automation

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
NONE
Integrity impact
PARTIAL
Availability impact
NONE
network
low complexity
bmc
CWE-285
nessus
exploit available

Summary

The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass authorization checks and make an RPC call via unspecified vectors.

Vulnerable Configurations

Part Description Count
Application
Bmc
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing Functionality Not Properly Constrained by ACLs
    In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application or can run queries for data that he is otherwise not supposed to.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Directory Indexing
    An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.

Exploit-Db

  • descriptionBMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure. CVE-2016-5063. Webapps exploit for Windows platform
    fileexploits/windows/webapps/43934.py
    idEDB-ID:43934
    last seen2018-01-30
    modified2018-01-30
    platformwindows
    port4750
    published2018-01-30
    reporterExploit-DB
    sourcehttps://www.exploit-db.com/download/43934/
    titleBMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure
    typewebapps
  • idEDB-ID:43902

Nessus

NASL familyMisc.
NASL idBMC_RSCD_ACL_BYPASS.NASL
descriptionThe remote BMC BladeLogic Server Automation (BSA) RSCD agent is affected by a security bypass vulnerability due to a failure to properly enforce the ACL. An unauthenticated, remote attacker can exploit this, by ignoring the response to the RemoteServer.info request, to bypass the ACL and execute XML-RPC commands. MITRE has assigned three different CVE identifiers to this vulnerability. CVE-2016-1542 and CVE-2016-1543 pertain to a variation where the exports file is bypassed, and CVE-2016-5063 concerns a variation where the users file is bypassed. Note that CVE-2016-1542 and CVE-2016-1543 affect the Linux and Unix variants of RSCD, and CVE-2016-5063 affects the Windows variant.
last seen2020-06-01
modified2020-06-02
plugin id90998
published2016-05-10
reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/90998
titleBMC Server Automation RSCD Agent ACL Bypass

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/146164/BMC_winUsers.py.txt
idPACKETSTORM:146164
last seen2018-01-31
published2018-01-30
reporterPaul Taylor
sourcehttps://packetstormsecurity.com/files/146164/BMC-BladeLogic-RSCD-Agent-8.3.00.64-Windows-Users-Disclosure.html
titleBMC BladeLogic RSCD Agent 8.3.00.64 Windows Users Disclosure

Seebug

bulletinFamilyexploit
idSSV:97121
last seen2018-06-26
modified2018-02-01
published2018-02-01
reporterKnownsec
sourcehttps://www.seebug.org/vuldb/ssvid-97121
titleBMC BladeLogic RSCD Agent 8.3.00.64 - Windows Users Disclosure