Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Potential information disclosure relating to BI-BIP-AUT, SAP security note 2001109

SAP Note 2001109
SAP Security Note
High priority

SAP security note 2001109, “Potential information disclosure relating to BI-BIP-AUT”, is a program error note released on 04.11.2015. Below are the symptom and SAP recommended solution.

ComponentBusiness intelligence solutions > Business intelligence platform > Authentication, ActiveDirectory, LDAP, SSO, Vintela
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released on04.11.2015
LanguageEnglish

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 2120370.

An attacker can discover information relating to BI-BIP-AUT. This information could be used to allow the attacker to specialize their attacks against BI-BIP.

Solution

Install one of the following patches or their subsequent patches:

  • BI 4.0 Patch 9.1
  • BI 4.0 SP10
  • BI 4.1 SP04
  • BI 3.1 Patch 6.5

Reason and prerequisites

Using BI-BIP-AUT, an attacker can gain information about the BI system. This information may be used by an attacker to further target BI-BIP.

CVSS

Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N

Full note on SAP: SAP Support Launchpad note 2001109

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Information Disclosure #BI-BIP #Authentication #LDAP #SSO

Explore More