Collisions during UUID generation in SAP NetWeaver Java Server, SAP security note 2499109

SAP security note 2499109, "Collisions during UUID generation in SAP NetWeaver Java Server", is a program error note released on 08.08.2017. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

NW Java Server random number generator is broken (race condition in parallel threads):

• Two requestors of a random number might get the same "random" number.
• An exception might occur in the random number generator.

This can result in several security and functional issues:

• UUID collision is possible.
• Cryptographic key generated by NW Java Server might be broken.
• Two different sessions might have identical Session IDs. Session hijacking might be possible.
• Functional errors like "HTTP Error 500", "This page isn’t working" or similar after login to Netweaver/Portal.
• Output like "500 Internal Server Error" instead of Logon Dialog in Netweaver/Portal.
• Error of type GC Allocation Failure.
• Outgoing TLS connections fail with various exceptions during key generation.

Solution

To apply this update, install the Support Package Add-on (SCA) attached to this note corresponding to your codeline/SP level.

We recommend performing this update even if no errors have been observed previously.

Reason and prerequisites

Due to changes introduced in Java VM 1.8u112 regarding the synchronization of SecureRandom generation, each provider needs to synchronize its own methods to avoid collisions and race conditions. Until now, this was not implemented. The problem affects only NW750SP6 and upcoming NW750 service packs.

CVSS

Score 6.8 Vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

References

• 2553799 – 500 Internal Server Error when accessing Netweaver As Java Server
• 2556722 – Unable to Generate the Random Token
• 2555587 – Collective Note: SAP NetWeaver 7.5 SP10 – Application Server Java (AS Java)

Affected components

• CORE-TOOLS from version 7.50