SAP security note 1471118, "Information disclosure relating to server info". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can discover information relating to the SAP Java Web Application Server (WAS). The information accidentally disclosed above is only a dummy value and hence doesn’t have any major impact.
Solution
The issue described above has been fixed by removing the wdResMod.bat file altogether as this file is not relevant for SAP customers.
The above fix will be available in the latest Support Package (SP) of WebDynpro for Java on all releases. In the section "SP Patch Level," you can find information on which patches contain the respective correction. Please install this patch or a newer one as WebDynpro patches are always cumulative.
Information on how to apply the WebDynpro for Java patches for releases NetWeaver 6.40, 7.00, 7.01 & 7.02 can be found in SAP Note 1395627.
Information on how to apply the WebDynpro for Java patches for releases NetWeaver 7.10, 7.11 & 7.20 can be found in SAP Note 1395865.
Reason and prerequisites
Information such as the Software Deployment Manager (SDM) user passwords can be discovered through the use of a batch file named wdResMod.bat, residing on the SAP Java Web Application Server’s filesystem. The password disclosed here is only a dummy value and not the actual SDM password.
Affected components
- SAP_JTECHF: 6.40 to 7.02
- WD-RUNTIME: 7.10 to 7.30
Full note on SAP: SAP Support Launchpad note 1471118
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
