CVE-2016-1543
published 2016-06-13CVE-2016-1543: The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to…
PriorityP277high7.5CVSS 3.0
AVNACLPRNUINSUCNIHAN
EXPLOIT
EPSS
71.85%
99.3th percentile
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
| bmc | bladelogic_server_automation_console | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x00\x00\x00\x5e\x30\x30\x30\x30\x30\x30\x35\x36\x30\x30\x30\x30\x30\x30\x31\x31\x36\x35\x3b\x30\x3b\x33\x35\x3b\x38\x38\x30\x3b\x38\x38\x30\x3b\x30\x30\x30\x30\x30\x30\x30\x33\x35\x30\x3b\x30\x3b\x37\x3b
bytes↗
\x00\x00\x00\x5a\x30\x30\x30\x30\x30\x30\x35\x32\x30\x30\x30\x30\x30\x30\x31\x31\x36\x35\x3b\x30\x3b\x33\x31\x3b\x64\x61\x34\x3b\x64\x61\x34\x3b\x30\x30\x30\x30\x30\x30\x30\x33\x31\x30\x3b\x30\x3b\x37\x3b
bytes↗
\x00\x00\x00\x32\x30\x30\x30\x30\x30\x30\x32\x61\x30\x30\x30\x30\x30\x30\x31\x30\x36\x34\x3b\x30\x3b\x32\x3b\x36\x66\x37\x3b\x38\x38\x30\x3b\x30\x30\x30\x30\x30\x30\x30\x30\x32\x34\x31\x30\x30\x30\x30\x30\x30\x30\x30
- →Detect exploit initiation by monitoring for the literal string 'TLS' or 'TLSRPC' sent as the first bytes of a TCP connection to port 4750, followed by an SSL/TLS upgrade — this is the characteristic handshake used by both exploit variants. ↗
- →Detect unauthenticated XMLRPC POST requests to /xmlrpc on port 4750 over a TLS-wrapped raw TCP socket (not standard HTTPS), which is the attack path used by the Python exploit. ↗
- →Alert on XMLRPC action packets containing 'RemoteExec.exec' or 'RemoteServer.intro' XML elements sent to the RSCD agent on port 4750 without prior successful authentication — these are the two XML-RPC calls used to achieve unauthenticated RCE. ↗
- →Monitor for the fixed nexec auth packet byte sequence (starting \x00\x00\x00\x5a) on port 4750 — this is the fake nexec authorization packet sent by the Metasploit module to bypass authentication. ↗
- →Monitor for the fixed agentinfo auth packet byte sequence (starting \x00\x00\x00\x5e) on port 4750 — this is the fake agentinfo authorization packet used for both reconnaissance and exploitation. ↗
- →The exploit sends an action packet to xmlrpc after an authorization failure — detect sequences where an HTTP POST to /xmlrpc follows a failed auth response on the same TCP session to port 4750. ↗
- →Under Windows, watch for RSCD-spawned processes executing commands prefixed with 'cmd /c' as a child of the RSCD agent process, indicating generic command execution via the exploit. ↗
- ·The exploit upgrades the raw TCP connection to TLS before sending any RSCD protocol data, so network inspection must perform TLS interception on port 4750 to inspect payload content. ↗
- ·The Python exploit variant uses 'TLSRPC' (6 bytes) as the TLS upgrade trigger, while the Metasploit module uses 'TLS' (3 bytes); signatures must account for both variants. ↗
- ·Payload bad characters are \x00, \x09, and \x0a — encoded payloads will not contain these bytes, and back slashes are encoded as \xc1\xdc and double quotes as \xc2\x68 in command packets. ↗
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
cisa7.5HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6773-9q85-x9gw: The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8
ghsa_unreviewed·2022-05-14
CVE-2016-1543 [HIGH] CWE-284 GHSA-6773-9q85-x9gw: The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8
The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
CISA
Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability
cisa·2022-03-03·CVSS 7.5
CVE-2016-8562 [HIGH] CWE-20 Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability
Vulnerability: Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability
Affected: Siemens SIMATIC CP
An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2016-8562
Remediation Due Date: 2022-03-24
No detection rules found.
Exploit-DB
BMC Server Automation RSCD Agent - NSH Remote Command Execution (Metasploit)
exploitdb·2018-02-01
CVE-2016-1543 BMC Server Automation RSCD Agent - NSH Remote Command Execution (Metasploit)
BMC Server Automation RSCD Agent - NSH Remote Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'BMC Server Automation RSCD Agent NSH Remote ' \
'Command Execution',
'Description' => %q(
This module exploits a weak access control check in the BMC Server
Automation RSCD agent that allows arbitrary operating system commands
to be executed without authentication.
Note: Under Windows, non-powershell commands may need to be prefixed
with 'cmd /c'.
),
'Author' =>
[
'Olga Yanushkevich, ERNW ', # Vulnerability discovery
'Nicky Bloor (@NickstaDB) ' # RCE payload and Metasploit module
],
'References' =>
[
['URL', 'https://insinuator.net/2016/03/bmc-blade
Exploit-DB
BMC BladeLogic 8.3.00.64 - Remote Command Execution
exploitdb·2018-01-26·CVSS 7.5
CVE-2016-1543 [HIGH] BMC BladeLogic 8.3.00.64 - Remote Command Execution
BMC BladeLogic 8.3.00.64 - Remote Command Execution
---
# Exploit Title: BMC BladeLogic RSCD agent remote exec - XMLRPC version
# Filename: BMC_rexec.py
# Github: https://github.com/bao7uo/bmc_bladelogic
# Date: 2018-01-24
# Exploit Author: Paul Taylor / Foregenix Ltd
# Website: http://www.foregenix.com/blog
# Version: BMC RSCD agent 8.3.00.64
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
# Vendor Advisory: https://docs.bmc.com/docs/ServerAutomation/87/release-notes-and-notices/flashes/notification-of-critical-security-issue-in-bmc-server-automation-cve-2016-1542-cve-2016-1543
# Tested on: 8.3.00.64
#!/usr/bin/python
# BMC BladeLogic RSCD agent remote exec - XMLRPC version
# CVE: CVE-2016-1542 (BMC-2015-0010), CVE-2016-1543 (BMC-2015-0011)
# By Paul Taylor / Fore
Metasploit
BMC Server Automation RSCD Agent NSH Remote
metasploit
BMC Server Automation RSCD Agent NSH Remote
BMC Server Automation RSCD Agent NSH Remote
This module exploits a weak access control check in the BMC Server Automation RSCD agent that allows arbitrary operating system commands to be executed without authentication. Note: Under Windows, non-powershell commands may need to be prefixed with 'cmd /c'.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.htmlhttp://www.securityfocus.com/archive/1/537910/100/0/threadedhttps://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solutionhttps://www.exploit-db.com/exploits/43902/https://www.exploit-db.com/exploits/43939/https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/http://packetstormsecurity.com/files/136462/BMC-Server-Automation-BSA-RSCD-Agent-Unauthorized-Password-Reset.htmlhttp://www.securityfocus.com/archive/1/537910/100/0/threadedhttps://selfservice.bmc.com/casemgmt/sc_KnowledgeArticle?sfdcid=kA214000000dBpnCAE&type=Solutionhttps://www.exploit-db.com/exploits/43902/https://www.exploit-db.com/exploits/43939/https://www.insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/
2016-06-13
Published