Tomcat on MSA accessible from the network, SAP security note 1525994

SAP security note 1525994, “Tomcat on MSA accessible from the network”, released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Apache Tomcat server delivered with SAP CRM Mobile Sales, which is required by the IPC (Internet Pricing & Configuration) user interface, is accessible from the network. This vulnerability could be exploited by a malicious user on the network to read and modify data.

Solution

To mitigate this vulnerability, you need to ensure that requests not originating from the local machine are not processed by Tomcat. SAP CRM Mobile Sales only requires local requests to the server. Follow these steps to implement the solution:

• Edit the server.xml File. Open Tomcat’s server.xml file located in the Tomcat configuration directory, typically under tomcat5\conf within your SAP CRM Mobile Sales installation directory.
• Locate the HTTP/1.1 Connector. In the server.xml file, find the <Connector> elements and look for the HTTP/1.1 Connector, which is bound to port 8080 in the standard installation. It should be under the Service named "Catalina".
• Optional: Verify Current Access. To validate the current configuration, connect the machine running SAP CRM Mobile Sales to the network and try accessing the Tomcat server from another machine’s browser using http://[XXX]:8080. Replace [XXX] with the network address of the machine running SAP CRM Mobile Sales. You should see Tomcat’s start page if access is allowed.
• Restrict Access to Localhost. Add the following attribute to the <Connector> element identified in Step 2: address="127.0.0.1". Example: <!– Define a non-SSL HTTP/1.1 Connector on port 8080 –> <Connector port="8080" address="127.0.0.1" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" redirectPort="8443" acceptCount="100" connectionTimeout="20000" disableUploadTimeout="true" /> The "loopback address" 127.0.0.1 ensures that only requests from the local machine are processed by this connector. Documentation on this attribute can be found in the Tomcat HTTP Connector Configuration.
• Restart the IPC Server. Save the server.xml file and restart the IPC server. Shutdown: Right-click the SAP CRM Mobile Sales icon in the system tray and select "Exit (& Stop IPC)". Restart: Use the "SAP IPC Start" shortcut from the Start Menu.
• Verify the Configuration. After restarting, connect the machine to the network and attempt to access the Tomcat server from another machine’s browser using http://[XXX]:8080. If configured correctly, the browser should display an error indicating that the page cannot be displayed. Additionally, ensure that the hosts file (located at C:\Windows\System32\drivers\etc on Windows systems) contains a mapping of localhost to 127.0.0.1 to avoid access issues with the Mobile Sales application.

Reason and prerequisites

If you are using SAP CRM Mobile Sales, the standard installation of the Tomcat Server does not block non-local access, even though such access is never required. This can become a significant security issue if the computer running SAP CRM Mobile Sales is connected to a network.

Affected components

• APACHETOMCAT from version 5.5 to 6.0