SAP security note 2644238, "[CVE-2018-2438] Denial of service (DoS) in SAP Internet Graphics Server (IGS)". Below are the symptom and SAP recommended solution.
Description
Symptom
The SAP Internet Graphics Server (IGS) has several denial-of-service (DoS) vulnerabilities that allow an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service.
This security note covers five similar DoS vulnerabilities in SAP IGS.
- Long response delays and service interruptions, degrading service quality for legitimate users
- Direct impact on availability
Solution
SAP IGS now distinguishes between valid and non-valid requests, ensuring that non-valid requests are no longer processed. Additional input validation has been implemented in the affected areas.
Reason and prerequisites
The SAP IGS lacks sufficient request validation, allowing it to process invalid requests under certain conditions. Specifically, the HTTP and RFC listeners, portwatcher when registering to the multiplexer, and the multiplexer itself have inadequate input validation, permitting malformed data packets to cause crashes.
CVSS
Score 5.3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Full note on SAP: SAP Support Launchpad note 2644238
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].