Potential remote code execution in SAP Kernel, SAP security note 1487330

SAP security note 1487330 is titled "Potential remote code execution in SAP Kernel". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1529807.

A malicious user can exploit Kernel functions to enable them to take complete control of the product, including viewing, changing, or deleting data.

Solution

Apply the latest kernel patch with the patch level given in this note at least.

Reason and prerequisites

A buffer overflow vulnerability exists in the Kernel. This enables a malicious user to inject code into the working memory that is subsequently executed by the application. It can also be used to cause a general fault in the product, thereby producing a termination of the product.

References

• Update #1 to Security Note 1487330
• Automatic checks for security notes using RSECNOTE (outdated)
• Briefing at Black Hat conference on July 26th, 2012

Affected components

• KRNL32NUC: 4.6DEXT to 4.6DEX2, 6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.20EXT to 7.20EXT
• KRNL32UC: 6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.2L to 7.2L, 7.20EXT to 7.20EXT
• KRNL64NUC: 4.6DEXT to 4.6DEX2, 6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.20EXT to 7.20EXT
• KRNL64UC: 6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.2L to 7.2L, 7.20EXT to 7.20EXT
• SAP_BASIS: 46C to 46D, 610 to 620
• KERNEL: 4.6D to 4.6D, 6.40 to 6.40, 7.00 to 7.01, 7.10 to 7.11, 7.20 to 7.20, 7.2L to 7.2L