CVE-2019-0266 Potential Information Disclosure in SAP HANA Extended Application Services, Advanced Model, SAP security note 2724713

SAP security note 2724713, "[CVE-2019-0266] Potential Information Disclosure in SAP HANA Extended Application Services, Advanced Model", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Under certain conditions, SAP HANA Extended Application Services, advanced model (XS advanced) writes credentials of platform users to a trace file of the SAP HANA system. Although the trace file is protected from unauthorized access, the risk of information leakage is increased.

Impacts of Information Disclosure:

• Loss of information and system configuration confidentiality
• Information gathering for further exploits and attacks

Solution

• Do not pass user credentials as command line parameters to XSA CLI. Instead, provide credentials interactively.
• To prevent command line arguments from being written to HANA trace files:
  • Apply patch version 1.0.98 or later of XS advanced runtime
  • Update SAP HANA DB to at least the following revisions:
    • Revision 122.22 (for SAP HANA 1.00 SPS12)
    • Revision 24.08 (for SAP HANA 2.0 SPS02)
    • Revision 36.00 (for SAP HANA 2.0 SPS03)

Reason and prerequisites

Certain XSA CLI commands for managing XS advanced services require credentials to perform administrative tasks such as enabling a tenant DB or creating a support user. To facilitate batch script execution, some commands accept user credentials as command line parameters. This practice, while generally not recommended in production environments, can lead to credentials being written to the nameserver trace file. Although the file is exclusively readable by the <sid>adm of the SAP HANA system, the risk of credential leakage remains.

CVSS

Score 6.8 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected components

• HDB: Versions 1.00 and 2.00
• SAP_EXTENDED_APP_SERVICES: Version 1