SAP security note 1791490, "Potential denial of service in SAP Kernel (Diag parser)". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can remotely exploit the Diag Parser in the kernel, rendering it, and potentially the resources that are used to serve the Diag Parser, unavailable.
Solution
Apply the disp+work with the patch level specified in the "SP Patch Level" section of the SAP Note.
Reason and prerequisites
An attacker can trigger a condition in which the process creates a core dump, causing it to restart. This results in the entire machine becoming unresponsive until the process is available again. This flaw can be exploited to launch a denial-of-service (DoS) attack, intentionally provoking the condition to cause service disruption.
CVSS
Score 7.1 Vector: AV:N/AC:M/AU:N/C:N/I:N/A:C
Affected components
- Software Components: KRNL32NUC, KRNL32UC, KRNL64NUC, KRNL64UC, KERNEL
- Versions Affected: 4.6DEXT to 4.6DEX2, 6.40 to 6.40EX2, 7.20 to 7.21EXT, 7.38
Full note on SAP: SAP Support Launchpad note 1791490
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
