bugtraq - Multiple vulnerabilities in SAP WebAS 6.40 and 7.00 (technical details)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <1170972534.30877.5.camel@localhost>
Date: Thu, 08 Feb 2007 23:08:53 +0100
From: Nicob <nicob@...ob.net>
To: vulnwatch@...nwatch.org, bugtraq@...urityfocus.com,
	full-disclosure@...ts.grok.org.uk
Subject: Multiple vulnerabilities in SAP WebAS 6.40 and 7.00 (technical
	details)

       Multiple vulnerabilities in SAP Web Application Server
                        Technical details

Application : SAP Web AS 6.40 < patch 136 and 7.00 < patch 66
Platform : All platforms (except the third vulnerability)
Impacts : Remote file disclosure, remote DoS, local privilege escalation
Release Date : 8 February 2007
Author : Nicob <nicob at nicob.net>

Vulnerabilities technical details :
===================================

1) A remote file disclosure vulnerability allows reading any file to
which the user that the SAP Web Application Server is running as had
access. Under Windows, the service runs by default under the
SAPServiceJ2E account. This account is member of the local administrator
group.

Exploit : use "r3-stealer-1.0.pl" (attached)

Note : Absolute paths can be used, so "C:\boot.ini" and "\\10.11.12.13
\share\image.jpg" are both OK.

2) A remote denial of service allows crashing the enserver.exe process.

Exploit : send "\x72\xfe" on port UDP/64999

3) A local privilege escalation vulnerability allows any local user to
use the file disclosure vulnerability to access an user-controlled
process via a named pipe and impersonate as user SAPServiceJ2E. The
exploitation is possible only on Windows 2000 pre-SP4, Windows XP
pre-SP2 and Windows NT.

Exploit : use "r3-stealer-1.0.pl" (attached) and "tac0tac0.c" [1]

Solutions :
===========

Apply patch 136 or newer for version 6.40
Apply patch 66 or newer for version 7.00

Note : the mentioned patch level refers to the enqueue server
More details can be found in SAP notes 948457 and 959877

[1] : http://security.nnov.ru/files/tac0tac0.c

Nicob

Download attachment "r3-stealer-1.0.pl" of type "application/x-perl" (2951 bytes)