SAP security note 2094598, “Fixing POODLE SSLv3.0 Vulnerability in AS Java”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information related to SAP NetWeaver (NW) Application Server (AS) Java when using the SSL 3.0 protocol. Such information could allow the attacker to specialize attacks against AS Java.
As reported in CVE-2014-3566, a so-called man-in-the-middle attack is possible, even if the newer protocol version TLS 1.0 is enabled or configured in addition to SSLv3.
Solution
Apply the corrective measures according to the Validity and SP Patch Level sections of this note.
Reason and prerequisites
The SSL protocol 3.0 uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain clear text data via a padding-oracle attack, also known as the “POODLE” issue.
References
- 2088755 Disabling SSLv3.0 in Netweaver AS Java 6.40 -7.0x
- 2503155 TLS 1.2 Support in SAP NetWeaver AS Java 7.0x Systems
- 2110020 Enabling TLS or disabling SSLv3 protocol versions on SAP WebDispatcher, or SAP WebAS
Affected components
- SAP-JEECOR: 7.00 to 7.00
- SAP-JEECOR: 7.01 to 7.02
Full note on SAP: SAP Support Launchpad note 2094598
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
