SAP Security Note
SAP security note 1579478, “Hard-coded credentials in BC-MOB-MI-SER”, is released on November 13, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Security Note 1579478 addresses a critical vulnerability in the BC-MOB-MI-SER component. The program code contains a hard-coded username-password combination that alters system behavior upon successful authentication. This flaw allows a malicious user to authenticate without legitimate credentials or potentially escalate privileges if the hard-coded account has higher access rights.
A malicious user can leverage the hard-coded credentials to gain unauthorized access or escalate privileges, posing significant security risks to the system.
Solution
The note provides the necessary corrections to mitigate this vulnerability. It is highly recommended to apply the following support packages.
Affected components
- SAP_BASIS versions 700 to 702
- SAP_ABA version 640
Full note on SAP: SAP Support Launchpad note 1579478
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
