bugtraq - CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAP BC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1140010328.1621.32.camel@emij>
Date: Wed, 15 Feb 2006 10:32:08 -0300
From: Leandro Meiners <lmeiners@...sec.com>
To: bugtraq@...urityfocus.com
Subject: CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAP
	BC

(The following advisory is also available in PDF format for download at:
http://www.cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Arbitrary_File_Read_or_Delete_in_SAP_BC.pdf )

CYBSEC S.A.
www.cybsec.com

Pre-Advisory Name: Arbitrary File Read/Delete in SAP BC (Business
Connector)

Vulnerability Class: Improper Input Validation

Release Date: 02/15/2006

Affected Applications:  
* SAP BC 4.6
* SAP BC 4.7

Affected Platforms: Platform-Independent

Local / Remote: Remote

Severity: Medium

Author:  Leandro Meiners.

Vendor Status: Confirmed, patch released.

Reference to Vulnerability Disclosure Policy: 
http://www.cybsec.com/vulnerability_policy.pdf

Product Overview:
=================

SAP Business Connector (SAP BC) is a middleware application based on B2B
integration server from webMethods. It enables communication between SAP
applications and SAP R/3 and non-SAP applications, by making all SAP
functions accessible to business partners over the Internet as an
XML-based service.
The SAP Business Connector uses the Internet as a communication platform
and XML or HTML as the data format. It integrates non-SAP products by
using an open, non-proprietary technology.

Vulnerability Description:
==========================

SAP BC was found to allow reading and deleting any file from the file
system to which the user that the SAP BC is running as had access. The
vulnerability is present in the Monitoring functionality of the SAP
Adapter. 

Technical Details:
==================

Technical details will be released three months after publication of
this pre-advisory. This was agreed upon with SAP to allow their clients
to upgrade affected software prior to the technical knowledge been
publicly available. 

Impact:
=======

The Business Connector by default runs as a privileged user
(administrator on the Windows platform and root on *NIX platforms),
which allows ANY file on the File System to be read/deleted.

According to the SAP Business Connector Security Best Practices, the
following strategies are recommended for running the SAP BC in *NIX
environments:
1.	Running as non root user, using a high port.
2.	Running as non root user, using a high port and port remapping to
"see" the SAP BC in a restricted port.
3.	Running the JVM setuid root.
4.	Running SAP BC as root

If either strategy (1) or (2) was taken the scope of the vulnerability
was mitigated to allowing read/delete access to only the files owned by
the user which the BC was running as. However, if (3) or (4) had been
chosen ANY file on the File System could be read/deleted from the BC.
Moreover, (3) allowed any user of the Operating System to obtain root
since any Java program would be run with root privileges due to a SetUid
Java Virtual Machine.

The SAP Business Connector Security Best Practices has been corrected to
recommend running the BC as a non-root user and using a high-numbered
port or, if supported by the Operating System, giving the user
privileges to open a specific port below 1024 to be used by the BC.

Solutions:
==========

SAP released a patch regarding this issue, for versions 4.6 and 4.7 of
SAP BC. Details can be found in SAP note 906401.

Vendor Response:

* 12/06/2005: Initial Vendor Contact.
* 12/07/2005: Technical details for the vulnerabilities sent to vendor.
* 01/20/2006: Solution provided by vendor.
* 02/15/2006: Coordinate release of pre-advisory without technical
details.
* 05/15/2006: Coordinate release of advisory with technical details.

Contact Information:
====================

For more information regarding the vulnerability feel free to contact
the author at lmeiners<at>cybsec.com. Please bear in mind that technical
details will be disclosed three months after the release of this
pre-advisory, so such questions won't be answered until then. 

For more information regarding CYBSEC: www.cybsec.com

----------------------------
Leandro Meiners
CYBSEC S.A. Security Systems
E-mail: lmeiners@...sec.com
Tel/Fax: [54-11] 4382-1600
Web: http://www.cybsec.com
PGP-Key: http://pgp.mit.edu:11371/pks/lookup?search=lmeiners&op=index

Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)