Information disclosure in SAP MMC Console, SAP security note 2427292

SAP security note 2427292, “Information disclosure in SAP MMC Console”. Below are the symptom and SAP recommended solution.

Description

Symptom

SAP MMC console allows an attacker to gain access to the password of a hidden user. With these credentials, the attacker may be able to start or stop Java systems via the MMC Web Service.

Solution

Installing the latest patch resolves this issue.

Alternatively, you can manually replace jstart71.jar in $(DIR_CT_RUN) and in your instance tree $(DIR_INSTANCE)/j2ee/cluster with the attached version. This version introduces an additional check for accessing secure services. You can manage the parser with a new instance profile variable, which is a semicolon-separated list of allowed contexts with the following default: jstartup/service_acl = service:*; library:*; interface:*

To disable the checks, set the following: jstartup/service_acl = *

If your system behaves unexpectedly after installing the new jstart71.jar or the kernel, check the developer traces for the following warning and adjust the instance profile parameter to revert to the old behavior by adding the name of the context to jstartup/service_acl or by using the wildcard:

As a result, a user running programs in an application thread would fail to access protected service methods directly but would still be able to delegate requests to existing services that call these methods.

Reason and prerequisites

To exploit this security issue, an attacker would need developer privileges to create a Java Server Page or a Java Servlet.

CVSS

Score 6.6 Vector: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References