SAP Note 1501328SAP Security NoteHigh priority
SAP security note 1501328, "Potential Information Disclosure Relating to Passwords", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability allows a malicious user to discover password information in WebDynpro for Java, potentially enabling targeted password attacks.
Solution
Apply the WebDynpro for Java Patch.
- Update via JSPM: Refer to the official JSPM documentation for instructions on updating your system.
- NW04 / NW 6.40: Install SAR file patches and deploy SDAs using JSPM.
- NW04S / NW 7.00: Deploy SCA patches directly using JSPM.
- Recommendations: Apply both SAPJTECHF.sca and SAPJTECHS.sca. If any archive is not mentioned in the ‘SP Patch Level’ tab, apply the available patches from the SAP Service Marketplace.
Reason and prerequisites
Passwords can be exposed in WebDynpro for Java, which can be exploited to further target applications using this framework.
Affected components
- SAP-JEE 6.40
- SAP_JTECHS 7.00 to 7.02
- SAP_JTECHF 7.00 to 7.02
Full note on SAP: SAP Support Launchpad note 1501328
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
