CVE-2019-0307 Information Disclosure in Solution Manager 7.2 (Diagnostics Agent), SAP security note 2772266

SAP security note 2772266, "[CVE-2019-0307] Information Disclosure in Solution Manager 7.2 (Diagnostics Agent)", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Solution Manager 7.2 Diagnostics Agent stores several credentials unencrypted, including the SLD user connection and Solman user communication. These credentials are accessible by the Diagnostic Agent user (<SID>adm).

Impacts include:

• Loss of information and system configuration confidentiality
• Information gathering for further exploits and attacks

Solution

Upgrade to Support Package 9 (SP9). This update removes the mentioned users and addresses the credential storage issue.

For additional data encryption, SP9 introduces a new mechanism:

• Shut down the Diagnostics Agent.
• Add the parameter smd.agent.encrypt.secstore=true to the SMDAgent/configuration/runtime.properties file.
• If running on SAP JVM 8: restart the Agent. The secstore.properties file should now be encrypted, and a master.password file will be created. Both files should only be readable and writable by the <SID>adm user. If this fails, manually create a new secstore.
• If running on SAP JVM 6: delete the SMDAgent/configuration/secstore.properties file; use the smdsetup.sh script to configure all required properties; start the SMDAgent; in Agent Administration, go to the Agents > Non-authenticated Agents tab; select your agent and click Trust Agent; ensure the secstore.properties and master.password files exist and are only readable and writable by the <SID>adm user.

Reason and prerequisites

In version 7.1, the Diagnostics Agent could be configured to use basic authentication to connect to the Solution Manager. The credentials for this technical user are stored in the configuration/secstore.properties file and are not deleted upon upgrade, making them readable by users with <SID>adm privileges.

CVSS

Score 3.4