CVE-2018-2360 Missing Authentication check in Startup Service, SAP security note 2523961

SAP security note 2523961, "[CVE-2018-2360] Missing Authentication check in Startup Service", is a program error note released on 09.01.2018. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Startup Service is missing an authentication check for functionalities that require user identity and cause consumption of file system storage.

Solution

• Obsolete coding has been deactivated.
• Implement the patches referenced by this SAP Note.

CVSS

Score 5.8 Vector: AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References

Affected components

• KRNL64NUC 7.49
• KRNL64UC 7.49
• KRNL64UC 7.53
• KERNEL 7.45
• KERNEL 7.49
• KERNEL 7.52
• KERNEL 7.53
• KERNEL 7.70