SAP Security Note
High priority
SAP security note 2129892, "Potential Buffer overflow in PA-PAO", is a program error note released on 10.03.2015. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can exploit PA-PAO to enable them to take control of the product, including changing or deleting data.
Solution
To resolve this error in your system, apply the corrections contained in the Assigned Correction Instructions section of this note. Alternatively, apply the appropriate Support Package(s) indicated for your release in the Reference to Support Packages section of this note.
Reason and prerequisites
A buffer overflow vulnerability exists in PA-PAO. This enables an attacker to inject code into the working memory that is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.
Full note on SAP: SAP Support Launchpad note 2129892
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].