Advisory Details

December 9th, 2014

BMC Track-It! Web Account Credential Information Disclosure Vulnerability

CVE ID	CVE-2014-8270
CVSS SCORE	5.0, AV:N/AC:L/Au:N/C:P/I:N/A:N
AFFECTED VENDORS	BMC Software
AFFECTED PRODUCTS	Track-It!
TREND MICRO CUSTOMER PROTECTION	Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['16931']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS	This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of BMC Track-It!. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of password resets. The issue lies in the ability to register an account matching the name of a local account on the system and then reset the password for it. An attacker can leverage this vulnerability to gain credentials for the Administrator account on the system.
ADDITIONAL DETAILS	BMC Software has issued an update to correct this vulnerability. More details can be found at: http://support.numarasoftware.com/support/view_article.asp?ArticleID=7654
DISCLOSURE TIMELINE	2014-11-05 - Vulnerability reported to vendor 2014-12-09 - Coordinated public release of advisory
CREDIT	Brandon Perry

BACK TO ADVISORIES