Potential information disclosure relating to HANA host names, SAP security note 1914778

SAP security note 1914778, "Potential Information Disclosure Relating to HANA Host Names", is a program error note released on October 8, 2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can perform an HTTP request to determine the host name of servers running SAP HANA XS and identify the version of the SAP Web Dispatcher in use. This information can aid attackers in crafting targeted attacks against specific system configurations.

Solution

To mitigate this vulnerability, SAP recommends the following actions:

• Upgrade Recommendation: upgrade to SAP HANA revision 60 or higher. This version includes fixes that prevent the disclosure of host names and SAP Web Dispatcher versions.
• Configuration Change (if upgrading is not immediately possible): edit the configuration file – locate the sapwebdisp.pfl file, typically found at /usr/sap/<SID>/HDB<InstanceNumber>/<Host>/wdisp/sapwebdisp.pfl. Add or modify the following parameter: is/HTTP/show_detailed_errors = FALSE. Restart the SAP Web Dispatcher process by executing the command HDB restart, or alternatively manually kill the sapwebdisp_hdb process to trigger a restart.

CVSS

Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N

Affected components

• HDB: Version 1.00