what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

SAP XXE / Hardcoded Credentials / SQL Injection / Overflow

SAP XXE / Hardcoded Credentials / SQL Injection / Overflow
Posted Jun 11, 2015
Authored by Darya Maenkova, Diana Grigorieva, Rustem Gazizov, Vahagn Vardanyan

SAP has released the monthly critical patch update for June 2015. This patch update closes buffer overflow, remote SQL injection, XML eXternal Entity, and hardcoded credentials vulnerabilities.

tags | advisory, remote, overflow, vulnerability, sql injection, xxe
advisories | CVE-2015-0204
SHA-256 | 19387f24cc2e3fc9d5721e3adda4e660354e12481fa568f2e559c14584e13347

SAP XXE / Hardcoded Credentials / SQL Injection / Overflow

Change Mirror Download
SAP <http://www.sap.com/>has released the monthly critical patch update 
for June 2015. This patch update closes a lot of vulnerabilities in SAP
products. The most popular vulnerability is Missing Authorization Check.
This month, three critical vulnerabilities found by ERPScan researchers
Vahagn Vardanyan, Rustem Gazizov, and Diana Grigorieva were closed.

*Issues that were patched with the help of ERPScan*

Below are the details of SAP vulnerabilities that were found byERPScan
<http://www.erpscan.com/>researchers.

* An XML eXternal Entity vulnerability in SAP Mobile Platform
on-premise (CVSS Base Score:5.5).Updateis available in SAP Security
Note2159601 <https://service.sap.com/sap/support/notes/2159601>. An
attacker can use XML eXternal Entities to send specially crafted
unauthorized XML requests, which will be processed by the XML
parser. The attacker will get unauthorized access to the OS file system.
* A Hardcoded Credentials vulnerability in SAP Cross-System Tools
(CVSS Base Score:3.6).Updateis available in SAP Security Note2059659
<https://service.sap.com/sap/support/notes/2059659>. An attacker can
use hardcoded credentials for unauthorized access and perform
various actions in the system. In addition, it is likely that the
code will be implemented as a backdoor into the system.
* A Hardcoded Credentials vulnerability in SAP Data Transfer Workbench
(CVSS Base Score:2.1).Updateis available in SAP Security Note2057982
<https://service.sap.com/sap/support/notes/2057982>. An attacker can
use the hardcoded credentials for unauthorized access and perform
various actions in the system. In addition, it is likely that the
code will be implemented as a backdoor into the system.


*The most critical issues found by other researchers*

Some of our readers and clients asked us to categorize the most critical
SAP vulnerabilities to patch them first. Companies providing SAP
Security Audit, SAP Security Assessment, or SAP Penetration Testing
services can include these vulnerabilities in their checklists. The most
critical vulnerabilities of this update can be patched by the following
SAP Security Notes:

* 2151237 <https://service.sap.com/sap/support/notes/2151237>: SAP GUI
for Windows has a Buffer Overflow vulnerability (CVSS Base
Score:9.3). An attacker can use Buffer Overflow for injecting
specially crafted code into working memory, which will be executed
by the vulnerable application under the privileges of that
application. This can lead to the attacker taking complete control
over the application, denial of service, command execution, and
other attacks. In case of command execution,attackercan obtain
critical technical and business-related information stored in the
vulnerable SAP-system or escalate their own privileges. As for
denial of service, the process of the vulnerable component may be
terminated. For this time, nobody will be able to use this service,
which negatively influences business processes, system downtime,
and, consequently, business reputation. It is recommended to install
this SAP Security Note to prevent risks.
* 2129609 <https://service.sap.com/sap/support/notes/2129609>: SAP EP
JDBC Connector has an SQL Injection vulnerability (CVSS Base
Score:6.5). An attacker can use SQL Injections with the help of
specially crafted SQL queries. They can read and modify sensitive
information from a database, execute administrative operations in a
database, destroy data or make it unavailable. In some cases, an
attacker can access system data or execute OS commands. It is
recommended to install this SAP Security Note to prevent risks.
* 1997734 <https://service.sap.com/sap/support/notes/1997734>: SAP RFC
runtime has a Missing AuthorizationXheckvulnerability (CVSS Base
Score:6.0). An attacker can use Missing Authorization Checks to
access a service without any authorization procedures and use
service functionality that has restricted access. This can lead to
information disclosure, privilege escalation, and other attacks. It
is recommended to install this SAP Security Note to prevent risks.
* 2163306 <https://service.sap.com/sap/support/notes/2163306>: SAP
CommonCryptoLib and SAPCRYPTOLIB are vulnerable to FREAK
(CVE-2015-0204, CVSS Base Score:5.0). It allows an attacker to
intercept HTTPS connections between vulnerable clients and servers
and force them to use weakened encryption, which the attacker can
break to steal or manipulate sensitive data. All the attacks on this
page assume a network adversary (i.e. a man-in-the-middle) to tamper
with TLS handshake messages. The typical scenario to mount such
attacks is by tampering with the Domain Name System (DNS), for
example via DNS rebinding or domain name seizure. This attack
targets a class of deliberately weak export cipher suites. It is
recommended to install this SAP Security Note to prevent risks.


*References about the FREAK vulnerability:*

* SMACK: State Machine AttaCKs <https://www.smacktls.com/>
* Tracking the FREAK Attack <https://freakattack.com/>
* CVE-2015-0204
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204>


It is highly recommended to patch all those SAP vulnerabilities to
prevent business risks affecting your SAP systems.

SAP has traditionally thanked the security researchers from ERPScan for
found vulnerabilities on theiracknowledgment page
<http://scn.sap.com/docs/DOC-8218>.

Advisories for those SAP vulnerabilities with technical details will be
available in 3 months onerpscan.com <http://www.erpscan.com/>.

--

Darya Maenkova

PR manager

<https://www.linkedin.com/company/2217474?trk=ppro_cprof>
<https://twitter.com/erpscan>

<http://erpscan.com/>

------------------------------------------------------------------------

e-mail: d.maenkova@erpscan.com <mailto:d.maenkova@erpscan.com>

address: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301

phone: 650.798.5255

erpscan.com <http://erpscan.com>

Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    0 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close