exploit the possibilities

SAP-multiple.txt

SAP-multiple.txt
Posted Nov 6, 2006
Authored by Nicob

The SAP Web Application Server suffers from denial of service, remote file disclosure, and local privilege escalation vulnerabilities.

tags | advisory, remote, web, denial of service, local, vulnerability
MD5 | fb3d3058c79e768dd0f000090523bd13

SAP-multiple.txt

Change Mirror Download

Advisory Name : Multiple vulnerabilities in SAP Web Application Server
Release Date : 2 November 2006
Application : SAP Web AS 6.40 < patch 136 and 7.00 < patch 66
Platform : All platforms (except the third vulnerability)
Impacts : Remote file disclosure, remote DoS, local privilege escalation
Author : Nicob <nicob at nicob.net>
Vendor Status : Updated code is available to customers


Vulnerabilities Description :
=============================

The following vulnerabilities were found in the monitoring functionality
of the SAP Web Application Server :

1) A remote file disclosure vulnerability allows reading any file to
which the user that the SAP Web Application Server is running as had
access. Under Windows, the service runs by default under the
SAPServiceJ2E account. This account is member of the local administrator
group.

2) A remote denial of service allows crashing the enserver.exe process.

3) A local privilege escalation vulnerability allows any local user to
use the file disclosure vulnerability to access an user-controlled
process via a named pipe and impersonate as user SAPServiceJ2E. The
exploitation is possible only on Windows 2000 pre-SP4, Windows XP
pre-SP2 and Windows NT.

Technical Details :
===================

Technical details will be released three months after publication of
this pre-advisory. This was agreed upon with SAP to allow their clients
to upgrade affected software prior to the technical knowledge been
publicly available.

Mitigations :
=============

Vulnerability #1 : Restrict network access to TCP port 3200+SYSNR
Vulnerability #2 : Restrict network access to TCP port 3200+SYSNR
Vulnerability #3 : Disable local access to the server

Solutions :
===========

Apply patch 136 for version 6.40 or patch 66 for version 7.00
Note : the mentioned patch level refers to the enqueue server
More details can be found in SAP notes 948457 and 959877


Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    5 Files
  • 21
    Apr 21st
    1 Files
  • 22
    Apr 22nd
    10 Files
  • 23
    Apr 23rd
    22 Files
  • 24
    Apr 24th
    11 Files
  • 25
    Apr 25th
    15 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close