Potential denial of service in all programs using iXML, SAP security note 1594475

SAP security note 1594475, “Potential denial of service in all programs using iXML”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can remotely exploit a program using iXML, rendering it, and potentially the resources that are used to serve a program using iXML, unavailable.

Solution

Please apply the patch level mentioned in this note at least. The patch provided in this note includes corrections of ABAP programs, new profile parameters, corrections of the SAP kernel (disp+work.exe), and corrections of the iXML DLL (dw_xml.dll). Please note that the basic security solution is delivered by the patch level mentioned in this note.

With the support package mentioned in this note, extensions of the basic security solution are made available to developers using iXML. It is not possible to apply these changes via correction instructions. By implementing this note, iXML provides new options for DTD processing to avoid Denial of Service attacks by using XML bombs.

Protection against XML bombs:

• Administrator (system wide): set the new profile parameter ixml/dtd_restriction to expansion, and set the new profile parameter ixml/xml_expansion_factor to a proper value (the default is 10).
• Programmer (for the current parsed XML document): use the new method SET_DTD_RESTRICTION of the interface IF_IXML_ISTREAM, and use the new method SET_MAX_EXPANSION of the interface IF_IXML_ISTREAM to set a program-specific threshold.

How to protect your XML services:

• If you are not providing services that may be vulnerable to XML bombs, you can retain your current settings.
• To protect all your services, set the profile parameter ixml/dtd_restriction to expansion. This may slightly slow down XML processing. If you encounter false DoS detections, consider increasing the value of the ixml/xml_expansion_factor.
• Each service can have its individual settings by using the new methods of the IF_IXML_ISTREAM interface.
• When using XSLT programs, create an iXML IStream based on your source XML document and use this IStream in the CALL TRANSFORMATION statement instead of the former XML input.
• Alternatively, replace your XSLT programs with Simple Transformation programs, which do not support DTDs.

Reason and prerequisites

The problem is caused by a resource exhaustion condition. An attacker can launch a specifically crafted request that causes the process to consume excessive resources. As a result, no other processes can allocate new resources, rendering the system unavailable. This condition can be intentionally provoked by an attacker to cause a denial of service.

CVSS

Score 4.0 Vector: AV:N/AC:L/AU:SC:N/I:N/A:P

References

Affected components

• KRNL32NUC (4.6DEXT to 4.6DEX2, 6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.20EXT)
• KRNL32UC (same version ranges as KRNL32NUC)
• KRNL64NUC (same version ranges as KRNL32NUC)
• KRNL64UC (same version ranges as KRNL32NUC, plus 8.00 and 8.02)
• SAP_BASIS (610 to 731, with specific support packages)
• KERNEL (4.6D to 8.02, with specific support packages)