Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Signature wrapping attack, SAP security note 1641208

SAP Note 1641208
SAP Security Note
HotNews

SAP security note 1641208, "Signature wrapping attack", is a program error note released on April 10, 2012. Below are the symptom, SAP recommended solution and the affected software components.

ComponentBasis Components > NetWeaver Application Server Java > Security, User Management > Web Services Security
CategoryProgram error
PriorityHotNews
TypeSAP Security Note
Version1
StatusReleased for Customer
Released onApril 10, 2012
LanguageEnglish

Description

Symptom

It is possible to add malicious content to signed XML messages and break their integrity, impersonate or manipulate data in an incorrect way, depending on the exposed web service.

Solution

Update to the latest patch level.

Ensure all relevant components are updated to mitigate the vulnerability effectively. Review the support package patches to apply the necessary updates specific to your environment.

Affected components

  • ENGINEAPI versions 7.10 to 7.31+
  • SAP-JEECOR versions 6.40 to 7.02+

Full note on SAP: SAP Support Launchpad note 1641208

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Web Services Security #Security, User Management #NetWeaver Application Server Java

Explore More