Denial of service (DOS) in “System Messages” area in DOE Administration Portal, SAP security note 2410061

SAP security note 2410061, "Denial of Service (DOS) in "System Messages" area in DOE Administration Portal". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The "System Messages" area in the DOE Administration Portal allows an attacker to prevent legitimate users from accessing a service by crashing or flooding the service.

• Availability: High impact due to potential service interruptions and degraded performance for legitimate users.
• Confidentiality & Integrity: No direct impact.

Solution

Implement the corrections provided in SAP Note 2410061. The implementation will modify the create method in the smmw_sys_msg class to restrict the lifetime field, preventing users from entering an excessive number of days.

Reason and prerequisites

The DOS vulnerability arises from an overflow of data when fetching the lifetime data for system messages. There was no restriction on the data saved in this field during the creation of system messages.

• Encountering a 500 SAP Internal Server Error.
• Using one of the following versions: NWAs 710: SP16 to SP21, NWAs 711: SP12 to SP16, NWAs 730: SP12 to SP16, SUPDOE Add-On 731: SP01 to SP04.

CVSS

Score 7.7 Vector: AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

References

Affected components

• SAP_BASIS: 710 to 711, 730
• SUPDOE: 731