SAP security note 1771200, "Potential information disclosure relating to AS Java". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to AS Java by using a telnet command. This information could be used to allow the attacker to specialize their attacks against AS Java.
Solution
Update your Java AS to a Support Package (SP) or release where the issue is fixed. See the SP Patch Level section for details and available patches.
Reason and prerequisites
Information such as user passwords can be discovered when using the telnet command. This information may be used by an attacker to further target AS Java.
Affected components
- Basis Components > NetWeaver Application Server Java > Enterprise Runtime, Core J2EE Framework
Full note on SAP: SAP Support Launchpad note 1771200
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
