bugtraq - [ESNC-2013-003] Remote OS Command Execution in SAP BASIS Communication Services

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHZd9dn1Qfo8uMVyk=cbtDV6=431GLpSKuDPGJ1c_oxvxveAFw@mail.gmail.com>
Date: Tue, 16 Apr 2013 17:45:36 +0200
From: ESNC Security <secure@...c.de>
To: bugtraq@...urityfocus.com
Subject: [ESNC-2013-003] Remote OS Command Execution in SAP BASIS
 Communication Services

[ESNC-2013-003] Remote OS Command Execution in SAP BASIS Communication Services

Please refer to www.esnc.de for the original security advisory,
updates and additional information.

------------------------------------------------------------------------
1. Business Impact
------------------------------------------------------------------------

This vulnerability allows executing arbitrary operating system
commands on the remote SAP system with the rights of the SAP
application user.

By exploiting this vulnerability, an attacker can take complete
control of the SAP application and data remotely via e.g. RFC protocol
or over the web via SAP's RFC-SOAP interfaces. Attacker can therefore
manipulate/extract business data and control the business logic.

Although vendor claims confidentiality, integrity and availability is
only partially affected (C:P/I:P/A:P) resulting a CVSS score of 6.0,
we believe this does not reflect the actual risk.

Risk Level: High

------------------------------------------------------------------------
2. Advisory Information
------------------------------------------------------------------------

-- ESNC Security Advisory ID: ESNC-2013-003
-- CVE ID: CVE-2013-3063
-- Original security advisory:
http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/39-remote-code-execution-in-sap-connect-communication-services
-- Reporting Date: 05.09.2011
-- Vendor Patch Date: 08.01.2013
-- Public Advisory Date: 16.04.2013
-- Researcher: Ertunga Arsal

------------------------------------------------------------------------
3. Vulnerability Information
------------------------------------------------------------------------

-- Vendor: SAP
-- Affected Components: Basis Components- Communication Services
-- Affected Versions: 4.6B-7.30 - Please refer to SAP note for more information
-- Vulnerability Class: Remote Operating System Command Injection
-- CVSS v2 score by the vendor: 6.0 (AV:N/AC:M/AU:S/C:P/I:P/A:P)
-- Remotely Exploitable: Yes
-- Authentication Required: Yes
-- Additional Notes: An exploit for this vulnerability is available in
ESNC Penetration Testing Suite

------------------------------------------------------------------------
4. Solution
------------------------------------------------------------------------

Please apply the security patch [SAP Note 1674132] supplied by the vendor.
More information can be found at vendor's site:

https://service.sap.com/sap/support/notes/1674132

------------------------------------------------------------------------
About ESNC
------------------------------------------------------------------------

ESNC GmbH, Germany is a company specialized in SAP security audit, SAP
penetration testing, ABAP security review and SAP vulnerability
assessment services.

It's flagship product ESNC Security Suite is used by many large
enterprises for vulnerability scanning their SAP ABAP and Java
systems, running ABAP code security reviews, enforcing SAP security
baselines and managing compliance.

For more information about our products and services, please visit our
web page at www.esnc.de