Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Collisions during UUID generation in SAP NetWeaver Java Server, SAP security note 2499109

Description

NW Java Server random number generator is broken (race condition in parallel threads):

  • Two requestors of a random number might get the same “random” number.
  • An exception might occur in the random number generator

This can result in several security and functional issues:

  • UUID collision is possible.
  • Cryptographic key generated by NW Java Server might be broken
  • Two different sessions might have identical Session IDs. Session hijacking might be possible
  • Functional error like “HTTP Error 500”, “This page isn’t working” or similar after login to Netweaver/Portal
  • Output like “500 Internal Server Error” instead of Logon Dialog in Netweaver/Portal
  • Error of type GC Allocation Failure
  • Outgoing TLS connections fail with various exceptions during key generation

CVSS Information

CVSS v3 Base Score: 6.8 / 10
CVSS v3 Base Vector:

AV : Attack Vector (Related exploit range)

Network (N)

AC : Attack Complexity (Required attack complexity)

Low (L)

PR : Privileges Required (Level of privileges needed to exploit)

Low (L)

UI : User Interaction (Required user participation)

Required (R)

S : Scope (Change in scope due to impact caused to components beyond the vulnerable component)

Unchanged (U)

C : Impact to Confidentiality

High (H)

I : Impact to Integrity

Low (L)

A : Impact to Availability

Low (L)

SAP provides this CVSS v3 base score as an estimate of the risk posed by the issue reported in this note. This estimate does not take into account your own system configuration or operational environment. It is not intended to replace any risk assessments you are advised to conduct when deciding on the applicability or priority of this SAP security note. For more information, see the FAQ section at https://support.sap.com/securitynotes.

Available fix and Supported packages

  • CORE-TOOLS | 7.50 | 7.50
  • J2EE ENGINE CORE TOOLS 7.50 | SP006 | 000003
  • J2EE ENGINE CORE TOOLS 7.50 | SP007 | 000002
  • J2EE ENGINE CORE TOOLS 7.50 | SP008 | 000001
  • J2EE ENGINE CORE TOOLS 7.50 | SP009 | 000000
  • J2EE ENGINE CORE TOOLS 7.50 | SP010 | 000000

Affected component

    BC-JAS-SEC-CPG
    Cryptography

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2499109

TAGS

#UUID
#&160-engineNextBytes
#&160-SecRandomSpi
#SecureRandom
#Session-ID

More to explorer

SAP Cloud Connector Certificate Validation Issue

Date of Release: February 13, 2024 Advisory ID: CVE-2024-25642 Affected Software: SAP Cloud Connector Versions Affected: 2.15.0 to 2.16.1 Vulnerability Summary:A critical vulnerability,

Protect Your SAP with RedRays Security Platform

Explore the Power of Our Scanner with an Interactive Prototype Below