Potential disclosure of information in SAProuter, SAP security note 1986895

SAP security note 1986895, "Potential disclosure of information in SAProuter", is a note. Below are the symptom, SAP recommended solution and affected software components.

Description

Symptom

An attacker can access information related to the SAProuter. This information could be used to tailor attacks against the SAProuter and network infrastructure.

Solution

Apply the SAProuter patch specified in Support Packages & Patches or a later patch.

Reason and prerequisites

Information such as host names, landscape configuration data, and user passwords can be disclosed through the use of SAProuter. This information may be used by an attacker to further target the network infrastructure.

CVSS

Score 2.6 Vector: AV:N/AC:H/AU:N/C:P/I:N/A:N

Affected components

• KRNL32NUC: 7.20, 7.20EXT, 7.21, 7.21EXT
• KRNL32UC: 7.20, 7.20EXT, 7.21, 7.21EXT
• KRNL64NUC: 7.20, 7.20EXT, 7.21, 7.21EXT, 7.40, 7.41
• KRNL64UC: 7.20, 7.20EXT, 7.21, 7.21EXT, 7.40, 7.41
• KERNEL: 7.20 to 7.21, 8.04, 7.40, 7.41