SAP Security Note
Medium priority
SAP security note 2786151, "[CVE-2019-0365] Denial of service (DOS) in SAP Kernel (RFC), SAP GUI for Windows and SAP GUI for Java", is a program error note released on September 24, 2019. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can prevent legitimate users from accessing a service by crashing or flooding the service, leading to:
- Long response delays and service interruptions
- Direct impact on availability
Solution
There is no workaround available; implement the corrections by installing the patch listed in this SAP Note.
The solution implements a bounds check to detect corruption in the RFC header. Upon detection, a short dump CALL_FUNCTION_READ_ERROR is generated, reporting the corruption of the RFC header under the section "Internal notes".
Reason and prerequisites
Using an unencrypted RFC connection and having trace activated with trace levels 2 or 3, a core dump of the ABAP server can be provoked. A manipulated RFC header due to a missing bounds check forces a core dump in the receiving process of an RFC connection.
CVSS
Score 5.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- CVE-2019-0365
Affected components
- SAP Kernel: Versions 7.21, 7.22, 7.49, 7.53, 7.73, 7.76 (32-bit and 64-bit, Unicode and non-Unicode)
- SAP GUI for Windows
- SAP GUI for Java
Full note on SAP: SAP Support Launchpad note 2786151
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].