Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Deserialization of untrusted data in SAP HANA XS Advanced Java Runtime, SAP security note 2252191

SAP Note 2252191
SAP Security Note
High priority

SAP security note 2252191, "Deserialization of untrusted data in SAP HANA XS Advanced Java Runtime", is released on April 12, 2016. Below are the symptom, SAP recommended solution and the affected software components.

ComponentBasis Components > HANA XS Advanced > XS Advanced Runtime / XS Controller
PriorityCorrection with high priority
TypeSAP Security Note
Released onApril 12, 2016

Description

Symptom

SAP HANA XS Advanced Java Runtime uses a version of Apache Commons Collections that deserializes untrusted data without sufficiently verifying its validity. This vulnerability may lead to remote command execution or a denial of service (DoS).

Solution

Update your AS Java to a Support Package (SP) or release where the fix is available. Refer to the Support Package Patch section for details and available patches.

CVSS

Score 7.3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected components

  • XS_TOMEE: Versions from 1.7 to 1.7

Full note on SAP: SAP Support Launchpad note 2252191

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XS Advanced Runtime #XS Controller #HANA XS Advanced #SAP HANA

Explore More