what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

SAP AG Netweaver 7.02 Remote Code Execution

SAP AG Netweaver 7.02 Remote Code Execution
Posted Aug 17, 2012
Authored by Michael Jordon | Site contextis.co.uk

SAP AG Netweaver version 7.02 suffers from a remote code execution vulnerability.

tags | advisory, remote, code execution
SHA-256 | bc9fad193d6f2e04e8df1bf4cfc5a190a25e5a0138df0d303bf2c0d262bf1e51

SAP AG Netweaver 7.02 Remote Code Execution

Change Mirror Download
===============================ADVISORY===============================
Systems Affected: SAP AG Netweaver 7.02
Severity: High
Category: Remote Code Execution
Author: Michael Jordon, Context Information Security
Reported to vendor: 16th September 2011
Advisory Issued: 17th August 2012
===============================ADVISORY===============================

Description
-----------
The SAPHostControl Service was found to be vulnerable to remote argument injection. This vulnerability allows for full
command execution as the SAP administrator through the SOAP management console from an unauthenticated perspective.

Analysis
--------
The issue relates to how the web service passes arguements into the database command line as part of the authentication
process. By manipulating these arguments a database script can be created and run which will execute commands as the SAP
administrator on the target server.
For further details on the vulnerability and exploit see:
http://www.contextis.com/research/blog/sap4/

Technologies Affected
---------------------
SAP NetWeaver 7.02 (SAPHostControl Service)

Vendor Response
---------------
SAP release a patch for the issue ref: 1341333.
https://websmp130.sap-ag.de/sap/support/notes/1341333

Disclosure Timeline
-------------------
16th September 2011 – Vendor Disclosure
8th May 2012 - Patch Released
17th August 2012 - Advisory Issued (SAP requested 3 months delay between patch release and advisory being issued)

Credits
--------
Michael Jordon of Context Information Security

About Context Information Security
----------------------------------------------
Context Information Security is an independent security consultancy specialising in both technical security and information
assurance services.
The company was founded in 1998. Its client base has grown steadily over the years, thanks in large part to personal
recommendations from existing clients who value us as business partners. We believe our success is based on the value our
clients place on our product-agnostic, holistic approach; the way we work closely with them to develop a tailored service;
and to the independence, integrity and technical skills of our consultants.
Context are ideally placed to work with clients worldwide with offices in the UK, Australia and Germany.
The company’s client base now includes some of the most prestigious blue chip companies in the world, as well as government
organisations.
The best security experts need to bring a broad portfolio of skills to the job, so Context has always sought to recruit
staff with extensive business experience as well as technical expertise. Our aim is to provide effective and practical
solutions, advice and support: when we report back to clients we always communicate our findings and recommendations in
plain terms at a business level as well as in the form of an in-depth technical report.

Web: www.contextis.com
Email: disclosure@contextis.com

Login or Register to add favorites

File Archive:

January 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    0 Files
  • 2
    Jan 2nd
    13 Files
  • 3
    Jan 3rd
    5 Files
  • 4
    Jan 4th
    5 Files
  • 5
    Jan 5th
    9 Files
  • 6
    Jan 6th
    5 Files
  • 7
    Jan 7th
    0 Files
  • 8
    Jan 8th
    0 Files
  • 9
    Jan 9th
    18 Files
  • 10
    Jan 10th
    31 Files
  • 11
    Jan 11th
    30 Files
  • 12
    Jan 12th
    33 Files
  • 13
    Jan 13th
    25 Files
  • 14
    Jan 14th
    0 Files
  • 15
    Jan 15th
    0 Files
  • 16
    Jan 16th
    7 Files
  • 17
    Jan 17th
    25 Files
  • 18
    Jan 18th
    38 Files
  • 19
    Jan 19th
    6 Files
  • 20
    Jan 20th
    21 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    24 Files
  • 24
    Jan 24th
    68 Files
  • 25
    Jan 25th
    22 Files
  • 26
    Jan 26th
    20 Files
  • 27
    Jan 27th
    17 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    20 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close