SAP Security Note
High priority
SAP security note 2042845, “Potential denial of service in Enqueue Server”, is a program error note released on 14.10.2014. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can remotely exploit the SAP Enqueue Server, rendering it, and potentially the resources that are used to serve Enqueue Server, unavailable.
Solution
Install the mentioned kernel patch. You can download the patch using the Download for SNOTE link or view the PDF Version.
Reason and prerequisites
An attacker can trigger a condition in which the process enters an endless loop, causing it to consume all of the available processing time. This causes the entire machine to become unresponsive until the process is terminated manually. An attacker can use this flaw to launch a denial-of-service (DoS) attack.
The problem is caused by a resource exhaustion condition. An attacker can launch a specifically crafted request that causes the process to consume excessive resources. As a result, no other processes can allocate new resources, rendering the system unavailable. This condition can be intentionally provoked by an attacker to cause a denial of service.
CVSS
Score 7.1 Vector: AV:N/AC:M/AU:N/C:N/I:N/A:C
Full note on SAP: SAP Support Launchpad note 2042845
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].