SAP Security Note
High priority
SAP security note 1510723, “Potential denial of service in PLM-CFO”, is a program error note released on 14.12.2010. Below are the symptom, reason and prerequisites, and the SAP recommended solution.
Description
Symptom
A malicious user can remotely exploit PLM-CFO to render it unavailable as well as potentially the resources that are used to serve PLM-CFO.
Solution
Please apply the correction instruction to resolve the issue.
Reason and prerequisites
A malicious user can trigger a condition in which the process enters an infinite loop, which causes it to consume all available processing time. This results in the entire machine being unresponsive until the process is manually killed. An adversary can use this flaw to launch a Denial of Service (DoS) attack.
Full note on SAP: SAP Support Launchpad note 1510723
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
