SAP security note 2442993, "Malicious SAP Host Agent Shutdown without Authentication". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can craft a specific SOAP request without authentication that causes a shutdown of the SAP Host Agent.
Solution
The issue is caused by a program error which is fixed with SAP Host Agent version 7.21 PL25.
Please upgrade SAP Host Agent to at least version 7.21 PL25. Please note, we always recommend to upgrade to the latest available version.
Follow the procedure described in Note 1031096.
The SAP Host Agent in SAP HANA has been updated with revision 122.10 (for SAP HANA1.00 SPS12), revision 2.02 (for SAP HANA2.0 SPS00), and revision 12 (for SAP HANA2.0 SPS01). Update to these or later versions.
Reason and prerequisites
Affected are all SAP Host Agent versions up to 7.21 PL24.
CVSS
Score 7.5 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
This note refers to
Affected components
- HDB: From 1.00 To 1.00
- HDB: From 2.00 To 2.00
- SAPHOSTAGENT: From 7.21 To 7.21+
Full note on SAP: SAP Support Launchpad note 2442993
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].