SAP security note 1621070, "Identification of SAP Web Servers through Banners". Below are the symptom and the SAP recommended solution.
Description
Symptom
Potential information disclosure relating to server version information.
Solution
Follow these steps to deactivate the server headers that reveal additional information.
I. Deactivate headers sent by the web container:
- Open Configtool.
- For versions prior to 7.10, go to cluster-data -> Global server configuration -> services -> http. For versions 7.10 and later, go to cluster-data -> template – (template-usage-type) -> services -> http.
- Click the UseServerHeader property, set its value to false, and press Set.
- Save, confirm all popups, and restart the server nodes for the change to take effect.
II. Deactivate the header sent by the ICM (versions 7.10 and newer only):
- In the profile file (default DEFAULT.PFL, located under /usr/sap/<SID>/SYS/profile/), set is/HTTP/show_server_header = FALSE.
- Restart ICM.
Reason and prerequisites
A malicious user can discover the server version using information contained in the server headers sent by default by the web container. This information could be used to allow the malicious user to specialize their attacks against the server.
Full note on SAP: SAP Support Launchpad note 1621070
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
