Untrusted XML input parsing possible in SPML Service, SAP security note 1621534

SAP security note 1621534, "Untrusted XML input parsing possible in SPML Service", is a program error note released on 11.09.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can modify an XML-based request to include XML content that is then parsed locally. This could allow a malicious user to perform a denial of service (DoS) on the parsing system, disclose local data returned in the response to the malicious request, or access further network-located resources accessible from the parsing system.

Solution

Apply the provided patches to your SAP NetWeaver Application Server Java.

Reason and prerequisites

The issue is caused by a program error in the SPML (Service Provisioning Markup Language) service of SAP NetWeaver Application Server Java due to the incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, which can lead to malicious content being parsed. This malicious content can reference internal resources, such as files, which can be disclosed in the response or used to perform a denial of service attack, rendering application content temporarily unavailable.

CVSS

Score 4.9 Vector: AV:A/AC:M/AU:S/C:P/I:P/A:P

Affected components

• SAP-JEE 6.40
• SAP_JTECHS 6.40 to 7.02
• UMEADMIN 7.00 to 7.31