Potential denial of service in Options, SAP security note 1500726

SAP security note 1500726, "Potential Denial of Service in Options", is a program error note released on 12.10.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can remotely exploit the /SAPPSSRM/CL_COPY_SAP_STRUC class and render it unavailable, as well as potentially affect the resources used to serve the /SAPPSSRM/CL_COPY_SAP_STRUC class.

Solution

Implement this SAP Security Note 1500726 or the related support package.

Reason and prerequisites

Infinite Loop: The code can cause an infinite loop. A malicious user can trigger a condition where the process enters an infinite loop, consuming all available processing time. This makes the entire machine unresponsive until the process is manually terminated. An adversary can exploit this flaw to launch a Denial of Service (DoS) attack.

Resource Exhaustion: The problem is caused by a resource exhaustion condition. An attacker can send a specifically crafted request that causes the process to consume excessive resources, preventing other processes from allocating new resources and rendering the system unavailable. This condition can be intentionally provoked by an adversary to cause a Denial of Service.

Affected components

• SRM_SERVER (550, 600)
• SRM_EXT (700, 701)