Directory Traversal Vulnerability in a Telnet Command, SAP security note 2280371

SAP security note 2280371, “Directory Traversal Vulnerability in a Telnet Command”, is a program error note released on 09.08.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

One of the telnet commands allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs.

Some well-known impacts of the directory traversal vulnerability are the following:

• An attacker could read content of arbitrary files on the remote server and expose sensitive data.
• An attacker could overwrite, delete, or corrupt arbitrary files on the remote server.

Solution

The file access outside of SAP Netweaver AS for Java instance installation directory has been prohibited for this command.

Update your Java AS to an SP or release where the issue is fixed. See the SP Patch Level section for details and available patches.

Reason and prerequisites

This behavior is due to a program error.

CVSS

Score 3.4 Vector: AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

References

Affected components

• SAP-JEECOR versions 7.00 to 7.02
• SERVERCORE versions 7.10 to 7.50