SAP security note 1661336, "Potential information disclosure relating to passwords", is a program error note released on 09.10.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to passwords being used by PI JMS Adapter. This information could be used to allow the attacker to specialize their attacks against passwords and PI JMS Adapter.
Solution
The issue has been resolved by code correction. The archives and the support package stack guide can be found on the SAP Service Marketplace.
Reason and prerequisites
Information such as the user passwords can be discovered using PI JMS Adapter. This information may be used by an attacker to further target SAP PI.
References
- SAP Note 1792077: SAP EHP1 FOR SAP NETWEAVER PI 7.1 SP11
- SAP Note 1792074: SAP Netweaver for PI 7.10 Support Package 16
- SAP Note 1724442: SAP EHP1 FOR SAP NETWEAVER PI 7.1 SP10
Affected components
- BC-XI-CON-JMS – Basis Components > NetWeaver Process Integration (PI) > Connectivity > JMS Adapter
Full note on SAP: SAP Support Launchpad note 1661336
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].