Airbus SAS - Jean-Romain Garnier - seclab@airbus.com

BMC Control-M/Agent default configuration does not enforce SSL/TLS allowing unauthorized actions and remote code execution

BMC Control-M/Agent memory corruption in SSL/TLS communication

BMC Control-M/Agent buffer overflow in SSL/TLS communication

BMC Control-M/Agent buffer overflow local privilege escalation

BMC Control-M/Agent path traversal local privilege escalation

BMC Control-M/Agent improper IP address filtering order

BMC Control-M/Agent unescaped NULL byte in access control list checks

BMC Control-M/Agent hardcoded Blowfish keys

BMC Control-M/Agent insecure default file permissions

BMC Control-M/Agent hardcoded default keystore password