SAP Security Note
Medium priority
SAP security note 2185409, "Potential information disclosure relating to passwords", is a program error note released on January 11, 2016. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information related to connection passwords. This information could be used to allow the attacker to specialize their attacks against database systems.
Solution
Implement the attached correction instruction. Ensure that you have applied the necessary composite notes to your support package level as per note 2034533.
Reason and prerequisites
Information such as connection passwords can be discovered using ESH_ADM_SET_TREX_DESTINATION. This information may be used by an attacker to further target a connected HANA database.
CVSS
Score 3.5 / 10 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N
Affected components
- SAP_BASIS (from 740 to 740)
Full note on SAP: SAP Support Launchpad note 2185409
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].