SAP security note 1503856, “Potential Information Disclosure Relating to Server Info”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This security note has been updated. For more detailed information, see Security Note 1581525 and Security Note 1740130.
A malicious user can discover information relating to the server installation of PI applications. This information could be used to allow the malicious user to specialize their attacks against the server and the applications.
Solution
Why should customers apply the patch? Applying the patch avoids the possibility of a malicious user trying to exploit version information using the vulnerabilities.
Reason and prerequisites
Information such as the installed products, versions of those products, and landscape configuration data can be discovered through the use of PI application administration pages. This information can potentially be used by a malicious user to further target PI applications.
CVSS
Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N
References
- Security Note 1889488 – Briefing at Black Hat conference on July 31st, 2013
- Security Note 1616259 – Briefing at Black Hat conference on August 4th, 2011
- Security Note 1740130 – Update 2 to Security Note 1503856
- Security Note 1581525 – Update #1 to Security Note 1503856
Affected components
- SAP NetWeaver 2004 (3.0)
- SAP NetWeaver 2004s (7.0)
- SAP EHP1 for SAP NetWeaver 7.0
- SAP EHP2 for SAP NetWeaver 7.0
- SAP NetWeaver PI 7.1
- SAP EHP1 for SAP PI NetWeaver 7.1
- SAP NetWeaver 7.2
- SAP NetWeaver 7.3
Full note on SAP: SAP Support Launchpad note 1503856
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
