SAP Security Note
HotNews
SAP security note 1649840, “Potential Remote Code Execution in SAP Message Server”, is released on February 14, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A buffer overflow vulnerability has been identified in the SAP Message Server. This vulnerability allows an attacker to inject and execute arbitrary code within the application’s working memory. Exploitation of this vulnerability can give the attacker complete control over the SAP system, enabling unauthorized viewing, modification, or deletion of data. Additionally, the vulnerability may cause the SAP Message Server to terminate unexpectedly, resulting in a denial of service.
Solution
To address this vulnerability, it is essential to install the latest patch level for the SAP Message Server as specified in this security note. Ensure that your SAP systems are updated to at least the following support packages:
- SAP KERNEL 8.03 64-BIT UNICODE: Support Package SP002 Patch 000002
- SAP KERNEL 7.20 64-BIT UNICODE: Support Package SP114 Patch 000114
- Additional support packages are listed in the Security Note
Affected components
- KRNL32NUC (4.6DEXT to 4.6DEX2, 6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.20EXT)
- KRNL32UC (6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.20EXT)
- KRNL64NUC (4.6DEXT to 4.6DEX2, 6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.20EXT)
- KRNL64UC (6.40 to 6.40EX2, 7.00 to 7.01, 7.10 to 7.20, 7.20EXT, 8.00 to 8.03)
- SAP_BASIS (Version 620)
- KERNEL (Various versions from 4.6D to 8.03)
Full note on SAP: SAP Support Launchpad note 1649840
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].