BMC Control-M/Server Cleartext Database Credentials Exposure Vulnerability

A vulnerability exists in BMC Control-M/Server version 9.0.21.300, where database credentials are exposed in cleartext within process lists and logs. This issue allows an authenticated attacker with shell access to view these credentials and potentially use them to access the database server. The vulnerability arises because Control-M/Server, when connected to a database, frequently executes a utility that includes sensitive connection details such as the username, password, database hostname, and port in cleartext. This information can be found in event and process logs in two separate locations.

Impact

Exploitation of this vulnerability could lead to unauthorized database access using the exposed credentials.

Remediation

Users can upgrade to BMC Control-M/Server version PACTV.9.0.21.307 to address this vulnerability. Instructions for installing this patch on both Linux and Windows are available in the BMC Control-M documentation.