full-disclosure - [ESNC-2013-001] Privilege Escalation in SAP Healthcare Industry Solution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAHZd9dmEUiiN2F80RyhEQ9CMTqdby1vzujk+49OL=BdhCvoaXw@mail.gmail.com>
Date: Tue, 16 Apr 2013 16:06:51 +0200
From: ESNC Security <secure@...c.de>
To: full-disclosure@...ts.grok.org.uk
Subject: [ESNC-2013-001] Privilege Escalation in SAP
	Healthcare Industry Solution

[ESNC-2013-001] Privilege Escalation in SAP Healthcare Industry Solution

Please refer to www.esnc.de for the original security advisory, updates and
additional information.
------------------------------------------------------------------------
1. Business Impact
------------------------------------------------------------------------

This vulnerability allows bypassing authority checks that exist before
executing a transaction. A transaction in SAP terminology is the execution
of a program.

By exploiting  this vulnerability, an attacker can also control the
transaction to be executed, allowing it to obtain critical rights in the
system and bypassing certain segregation of duties (SoD) restrictions.

Although this vulnerability is found in the SAP industry solution for
healthcare, the functionality is also present in the SAP ERP central
component (ECC 6). Thus, customers in other industries are also affected.

*Risk Level: High*
------------------------------------------------------------------------
2. Advisory Information
------------------------------------------------------------------------

-- Security Advisory ID: ESNC-2013-001
-- CVE ID: CVE-2013-3061
-- Original Security Advisory: http://www.esnc.de
/sap-security-audit-and-scan-services/security-advisories/36-privilege-escalation-in-sap-is-
healthcare
-- Vendor Patch Date: 2012-06-12
-- Public Advisory Date: 2013-04-16
-- Researcher: Ertunga Arsal
------------------------------------------------------------------------
3. Vulnerability Information
------------------------------------------------------------------------

-- Vendor: SAP
-- Affected Components: IS-H Industry-Specific Component Hospital
-- Vulnerable Function: ISHMED-PATRED_TRANSACT_RFCCALL
-- Vulnerability Class: Privilege Escalation
-- CVSS v2 score by the vendor: 6.0 (AV:N/AC:L/AU:N/C:P/I:P/A:P)
-- Remotely Exploitable: Yes
-- Authentication Required: Yes
------------------------------------------------------------------------
4. Solution
------------------------------------------------------------------------

Please apply the security patch [SAP Note 1691744] supplied by the vendor.
More information can be found at vendor's site:

https://service.sap.com/sap/support/notes/1691744
------------------------------------------------------------------------
About ESNC
------------------------------------------------------------------------

ESNC GmbH, Germany is a company specialized in SAP security audit, SAP
penetration testing, ABAP security review and SAP vulnerability assessment
services.

It's flagship product ESNC Security Suite is used by many large enterprises
for vulnerability scanning their SAP ABAP and Java systems, running ABAP code
security reviews, enforcing SAP security baselines and managing compliance.

For more information about our products and services, please visit our web
page at www.esnc.de

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/